Binance co-founder Yi He: Rumors of an engineer dating a North Korean spy are untrue
Binance co-founder Yi He responded to a rumor on X on November 1, saying that “this story is more dramatic, but it is not true,” and added that ZachXBT had not said anything related.
The rumor came from a post published the same day by the AlphaWire account, which said there were unverified allegations that a Binance DevOps engineer had developed a romantic relationship with a North Korean agent and had left a laptop unattended on the day of the attack. The post itself labeled these allegations as unverified, and said the related claim online was attributed to ZachXBT, but its original wording has not been independently verified. Binance previously said in a security incident update that the preliminary investigation showed the incident may have involved a DevOps engineer’s laptop being compromised, allowing the attacker to access service containers and submit unauthorized withdrawal transactions, and that no evidence of private key leakage was found.
Original sources:
Title: This story is more dramatic, but it is not true. ZachXBT never said that. Publisher: Yi He (@heyibinance) Publication date: 2026-11-01 URL: https://x.com/heyibinance/status/2116938024902902081 Source type: original post by a party involved Verification status: Read the original post and reply context for this report, verification date 2026-11-01 Supporting content: Yi He directly responded to the rumor, saying the story is more dramatic but not true, and that ZachXBT never said that.
Title: 🚨 BREAKING: BINANCE ENGINEER HAD ROMANTIC RELATIONSHIP WITH NORTH KOREAN SPY BEFORE $6.3B HACK Publisher: AlphaWire (@AlphaWireHQ) Publication date: 2026-11-01 URL: https://x.com/AlphaWireHQ/status/2116893978620555520 Source type: original post by a party involved Verification status: Read the full original post for this report, verification date 2026-11-01 Supporting content: The post raised unverified allegations involving a DevOps engineer’s romantic relationship with a North Korean agent and a laptop left unattended on the day of the attack; it also noted that the allegations were attributed online to ZachXBT, but the original wording has not been independently verified.
Title: Binance Co-CEO Yi He Denies Viral ‘North Korean Spy Romance’ Claim Behind $6.3B Hack Publisher: The Crypto Times Publication date: 2026-11-01 URL: https://www.cryptotimes.io/2026/11/02/binance-co-ceo-yi-he-denies-viral-north-korean-spy-romance-claim-behind-6-3b-hack/ Source type: media report Verification status: Read the key paragraphs of the report, verification date 2026-11-01 Supporting content: The report said Yi He denied the claim and described the AlphaWire post content; it quoted Binance’s official statement about the incident possibly involving a DevOps engineer’s laptop being compromised; and said Binance team told the media that the claim was completely false.
ABAB AI Insight
Yi He is a co-founder of Binance and currently serves as co-CEO, having long been responsible for customer service and market-related matters, and she co-founded the exchange with Changpeng Zhao. Her direct reply on X in Chinese was aimed at content in the AlphaWire post that was explicitly labeled as “unverified allegations,” rather than a rebuttal of confirmed technical details.
In Binance’s security incident update on October 29–30, the company only said the preliminary investigation pointed to a laptop belonging to a DevOps engineer possibly being compromised, and explicitly stated that no evidence of private key leakage was found. The FBI has attributed the overall incident to North Korean TraderTraitor, but the public materials do not mention any employee personal relationship or details about physical custody of the device. The AlphaWire post combined the publicly disclosed laptop clue with the North Korea attribution, then added unverified details such as a romantic relationship and the laptop being unattended, and mentioned that some people online had attributed it to ZachXBT. Yi He’s response simultaneously denied the story’s真实性 and the ZachXBT attribution.
Similar situations are not uncommon after major exchange incidents: confirmed technical entry points, such as a compromised endpoint, are often reworked into more dramatic personal stories to drive circulation. Yi He’s quick denial both addressed the specific rumor and cut off the false association with a well-known on-chain investigator. For the follow-up investigation, the publicly disclosed laptop clue remains the technical point still to be verified, while the personal-relationship storyline currently has no independent evidence supporting it.
ABAB News · Cognitive Law
When publicly disclosed technical clues are layered with unverified personal details, they quickly form a version with greater virality.
A direct denial by the person involved simultaneously cuts off the false source, but it does not automatically resolve the device-compromise investigation already mentioned by the official side.