Yi He confirms Binance once fired an employee for downloading iQiyi on a work computer, saying, “Pay the price and take responsibility, but don’t do it again”
Binance co-founder and co-CEO Yi He posted on the X platform on November 4, 2026, responding to outside discussion about internal device management after the security incident. She confirmed that the previously circulated story that an employee was fired for using a work computer to download iQiyi happened at Binance.
Yi He said that the person who was fired for downloading iQiyi on a work computer was also at Binance. She said to pay the price and take responsibility, but not to do it again. The post appeared after Binance released its preliminary investigation report on the October 29 security incident, which mentioned behavior such as engineers downloading malicious code through work computers.
Original source:
Title: The one who got fired for downloading iQiyi on a work computer was also at Binance. 🫠 Pay the price and take responsibility, but don’t do it again. Posted by: Yi He (@heyibinance) Date: 2026-11-04 URL: https://x.com/heyibinance/status/2117878817570328991 Source nature: firsthand original post Verification status: Read the full original post and contextual quotations in this report Support: Yi He confirmed that the firing incident happened at Binance and made the above remarks
ABAB AI Insight
Yi He is a co-founder of Binance and has long been responsible for customer service and operations. She has previously emphasized internal discipline in public, including how violations are handled. In 2025, she said that Binance’s internal investigation team handled more than 120 cases over two years and fired about 60 employees, involving incomplete information disclosure or undisclosed personal relationships. Her confirmation of the firing over “downloading iQiyi” continues her consistent stance on the boundaries of work-device use.
This statement directly responds to discussion about device management after the security incident. Binance’s preliminary investigation report had already disclosed facts such as Engineer A downloading a modified version of Homebrew through a search engine and Engineer B executing a malicious recruiting job repository on a work computer, with the attack ultimately reaching internal AI tools and wallet-signing services. By saying to “pay the price,” Yi He acknowledged responsibility, while emphasizing that it must not happen again, placing everyday device discipline alongside remediation after a state-level attack.
Compared with other large crypto platforms, similarly strict rules banning non-work use of work devices are not uncommon, but this incident shows that once endpoints are exploited, lateral movement can still reach core infrastructure. Yi He had previously denied rumors that the incident was attributed to a single employee’s romance or negligence. Her latest statement focuses on the company bearing the consequences and tightening discipline, rather than shifting blame to an individual.
This response changes the focus of outside discussion about Binance’s internal device policy: from whether strict rules exist to why strict rules failed to block the attack chain from an employee endpoint to the wallet-signing service. The company has rebuilt the affected systems and replaced devices, but Yi He’s remarks indicate that endpoint-use discipline remains one of the key links in preventing recurrence.
ABAB News · Cognitive Law
Using a work computer to download non-work software once led to a Binance employee being fired.
Yi He said the company would pay the price and take responsibility, but it must not make the same kind of mistake again.
Strict device discipline and the fact that the attack chain still reached core systems from the endpoint can both be true at the same time.