Key Takeaways
- Haipo Yang listed 3 failures at Binance, from shared devices to a multi-signature setup in name only.
- Binance says 98% of the $6.34B in impacted assets was replenished by Oct. 31 using company funds.
- Coinex itself is winding down, with withdrawals open until Dec. 22, 2026, as Yang cited security risks.
Industry Veterans Weigh-In
The founder of rival exchange Coinex weighed in on the largest theft in crypto history, stating the Binance breach exposed “at least three critical mistakes that were entirely avoidable.” Yang further added that it was a failure of operational discipline rather than a lack of sophisticated technology.
His comments came at a time when Binance is working through the fallout of a breach that the exchange says drained about $6.34 billion in assets from its hot wallets on Oct. 29. The FBI attributed the attack to North Korea’s Tradertraitor group.
The Three Mistakes
Yang’s list runs as follows:
- Work and personal computing were not separated: Yang said development and operations environments were “not completely isolated.” Staff with access to production systems, he argued, should have been using dedicated devices (with all coding, chat and web browsing being handled on a separate machine). That point maps directly onto what Binance disclosed in its most recent post-mortem.
- One key could run production: Yang said a single credential was enough to operate production services, meaning that one leak gave attackers full access. He suggested a browser-based session manager similar to Amazon Web Services’ (AWS) Session Manager, with hardware security keys as a second factor, so a single stolen credential would not amount to a breach.
- Multi-signature only on paper. Yang’s third point targeted Binance’s multi-party computation (MPC) setup, a method that splits signing authority among several parties. He said the signers did not meaningfully verify transactions, so compromising one node had the same effect as a single signature. Multi-signature only works, he argued, when each signer independently checks the transaction rather than trusting the request coming from upstream.
Binance Telling Of Events
Binance’s own account supports the outline of Yang’s critique as co-CEO Richard Teng told CNBC that after the fake interviews, the attackers “moved violently through our internal AI tools” and gained access to “the system that authorized our wallet transaction.” As Bitcoin.com News reported, the post-mortem tied the breach to a fake job interview and compromised artificial intelligence (AI) tools.
The exchange has since rebuilt the affected wallet system, replaced devices, revoked credentials and strengthened wallet-service risk controls. Teng also told Fox Business that the “company bears full responsibility,” while also noting that 98% of impacted assets have been replenished.
Yang is not the only voice posturing the hack as a risk-management failure. Zero Knowledge Group founder Austin Campbell told crypto media that “crypto never built itself for security outside of the tech vertical,” subsequently calling for a 24-hour hold on billion-dollar transfers.
A Critic With Skin in the Game
Yang’s critique carries an unusual backdrop, as in September, he announced that Coinex would begin an orderly shutdown, with withdrawals open until Dec. 22, 2026. He said then that the security and compliance risks of running an exchange had become harder to control, adding that “taking on unlimited risks for limited revenue is no longer a rational choice.”
In other words, the founder dissecting Binance’s failures decided the same risks were not worth carrying at his own firm.
Lastly, it bears mentioning that none of Yang’s fixes are exotic; i.e., device separation, hardware keys, and independent signer checks are all standard advice for any major firm. The fact that a firm with Binance’s resources was beaten through those gaps is what makes his post sting.
The bill has been steep regardless, with one analysis estimating Binance may have lost around half of five years of profits to fines and hacks. With hackers scattering stolen funds across 12,000 wallets, other exchanges are likely to face the same question Yang just posed: are their basics actually in place?
