CoinEx founder Haipo Yang has criticized Binance’s security practices following the reported $6.3 billion cryptocurrency theft on October 29. He identified three major security weaknesses that he believes could have prevented the attack, arguing that the problem was not a lack of advanced technology but a failure to follow basic security rules.
In a post on X, Yang criticized Binance’s handling of employee devices, authentication systems and transaction approvals. He said these weaknesses allowed attackers to gain access to sensitive systems and carry out unauthorized withdrawals.
Yang’s first concern was the lack of proper separation between work environments. He argued that employees handling live financial systems should use dedicated computers without unrelated software, while development work, web browsing and everyday communication should take place on separate devices.
His second concern was weak authentication. Yang said stolen employee credentials should never be enough to access production systems. He recommended stronger protection through hardware security keys and tools such as AWS Session Manager.
The third issue involved multi-party computation (MPC), a security method that divides transaction-signing responsibilities among multiple participants. Yang argued that each signer should independently verify every transaction before approving it. Without proper checks, the system could become vulnerable if one participant’s access is compromised.
He stressed that security systems only work when participants independently verify what they are approving.
Binance’s November 3 investigation report explained how the attackers gained access to its internal systems. The attack reportedly began in June when a wallet operations engineer downloaded a modified installer while trying to install an AI coding tool.
Although Binance detected the suspicious activity, replaced the affected computer and changed related credentials, the incident exposed information about employees working on its wallet infrastructure.
In September, attackers targeted another engineer through a fake recruitment process and convinced the employee to download malicious software. By October 20, they had gained access to additional engineering systems using compromised devices and internal tools.
On October 29, the attackers used stolen credentials to deploy malicious code that helped carry out unauthorized withdrawals.
Meanwhile, Binance co-CEO Richard Teng said the exchange had restored 98% of the affected assets. He also confirmed that Binance had completed another Proof of Reserves verification covering ten major cryptocurrencies, including Bitcoin, Ethereum, BNB and XRP.
Binance said around $2.85 billion worth of affected assets had been frozen or recovered through security and recovery efforts. The company has also committed to covering the remaining losses using its own resources.
Teng added that the exchange would continue working to restore the remaining assets, including cryptocurrencies with lower liquidity that may require additional purchases.
Binance co-CEO Yi He also revealed that the exchange had blocked 57 suspected North Korea-linked cyber threats during 2026. These attempts involved fake job interviews, malicious developer tools, infected software packages and fraudulent video conferencing applications.
She said attackers had used social engineering and malware to target employees and steal sensitive information. She also warned that even one successful attack could cause serious damage despite the company’s efforts to stop hundreds of threats.
Following the incident, Binance has replaced compromised devices, rebuilt affected wallet systems, strengthened authentication controls and expanded its monitoring of suspicious activity.
The exchange is also planning an independent cybersecurity review and further investment in employee device protection and threat detection.
Yang’s criticism highlights an important issue for cryptocurrency exchanges: even advanced security systems can fail when basic security procedures are not properly followed.