Binance founder Changpeng Zhao: This hack is more complex than the advice

Changpeng Zhao stepped down as Binance CEO in 2023 due to related U.S. Department of Justice allegations and remains the company’s main shareholder. This reply was made after Richard Teng had already clarified that the attack was not a one-click operation with a single engineer’s access, and it adds to his own terminal security advice published on October 28. That advice stressed not clicking links or downloading attachments, even from trusted sources, because the other party’s device may already be infected with a virus.

The current Binance incident initially points to a DevOps engineer’s laptop being compromised, which then allowed access to service containers and the submission of unauthorized withdrawals, consistent with the “compromised device” path emphasized by CZ. In 2019, Binance suffered a theft of about $40 million from its hot wallet; CZ then immediately paused withdrawals for about a week and completed a system migration. Compared with Bybit’s roughly $1.5 billion incident in 2025, in which the FBI determined that North Korea’s TraderTraitor group infiltrated the signing interface through a third-party developer’s device, both cases involved a compromised endpoint or interface rather than direct private key leakage, but Binance’s case is larger in scale and occurred at the internal service container layer.

CZ characterizes this attack as “more complex than the advice,” while also placing it within the general pattern that all hacks usually involve a compromised device or algorithm at some stage, helping shift attention from a single employee mistake to an industry-wide endpoint security issue. This does not change the fact that Binance has promised to cover losses with SAFU and company funds, but it reinforces his public statement as a shareholder about the complexity of the incident.

This statement changes the external interpretive frame for Binance’s internal controls: it further anchors the incident not in “a single engineer having too much access” but in a device compromise, a common industry entry point, while making clear that the attack process was more complex than the scenario addressed by ordinary phishing advice. For Binance, this temporarily reduces immediate criticism of a specific operational process, but it shifts the focus of the subsequent technical review to privilege separation and monitoring between devices and service containers; the key indicator will be whether the official review discloses the specific intrusion path and privilege boundaries of that engineer’s device.

ABAB News · Cognitive Law

1. All hacks usually involve a compromised device or algorithm at some stage, and a single-access-permission advisory cannot cover a more complex attack process.

2. A compromised endpoint can serve as an entry point for an attack, but that does not mean a single engineer’s privileges alone are enough to complete a funds transfer on the scale of tens of billions of dollars.