CoinEx Founder Says Binance’s $6.3B Theft Might Have Been Prevented
The FBI says more than $6 billion was stolen from Binance on or about October 29, 2026. Blockchain analytics firm TRM put the amount at about $6.36 billion. CoinEx founder Haipo Yang argues that basic security controls could have prevented the theft, but Binance has not confirmed his specific allegations.
- Yang questioned system separation, authentication and transaction approvals.
- Binance described an intrusion involving malware, social engineering and stolen credentials.
- The FBI attributed the theft to North Korean state-sponsored attackers.
- Binance reported replenishing 98% of affected assets, but recovery figures remain unclear.
Yang’s three security criticisms
In remarks reported on November 3, Yang said Binance may not have kept development systems separate from live production systems, adequately protected access against stolen credentials, or ensured that transaction signers independently scrutinized withdrawals.
“None of these require sophisticated technology. What was missing was discipline, ” Yang said.
These are Yang’s assessments, not confirmed findings from Binance’s investigation. Available reporting does not show that any of the alleged weaknesses directly enabled the theft.
Development systems are used to build and test software. Production systems handle live operations, including withdrawals. Keeping the two separate can limit the damage if a developer’s device or account is compromised.
Yang also recommended hardware security keys as an added safeguard for authentication. They can help resist some phishing attacks, but they are not a cure-all. Compromised devices or stolen active sessions may still pose risks.
Binance described a months-long intrusion
Binance’s November 3 incident account, detailed by crypto.news, describes an attack that began months before the theft. According to the account, a wallet operations engineer downloaded a modified Homebrew installer in June 2026 while trying to install an AI coding tool. Binance said it detected suspicious activity, replaced the affected computer and rotated related credentials.
In September, attackers reportedly used a fraudulent recruitment process to persuade another engineer to download malicious software. By October 20, they had used compromised devices and an internal AI tool to access additional engineering systems. Nine days later, stolen credentials enabled the deployment of malicious code used in unauthorized withdrawals.
The sequence shows how an attack can build over time. Social engineering, or manipulating people into exposing information or installing software, can give attackers an initial foothold. Malware and stolen credentials can then help them reach more sensitive systems.
This was a compromise of Binance’s wallet infrastructure, not a reported breach of the underlying blockchain networks. PBS reported that Binance said its hot wallet was affected, while most user assets were held in cold wallets, which are kept offline.
Transaction signing is only as strong as its checks
Yang’s criticism also raises questions about how Binance authorized withdrawals. Multi-party computation (MPC) distributes transaction-signing work among participants. Multisignature systems also distribute authority, but use a different technical approach. The terms are not interchangeable.
“Multisig only works when the signers are mutually distrustful, ” Yang said.
The broader question is whether one compromised identity, device or approval path could authorize a transaction without an effective independent check. Available information does not describe Binance’s specific signing setup in enough detail to determine whether Yang’s characterization is accurate.
The FBI attributed the theft to North Korean state-sponsored attackers and identified the activity as TraderTraitor. It said investigators observed the stolen assets being converted primarily into Ether. PBS separately reported that TRM assessed the attack as linked to TraderTraitor with high confidence, citing similarities to earlier North Korea-linked thefts. Attribution alone does not explain precisely how the attackers gained access.
What Binance’s recovery figures do and don’t show
Richard Teng, Binance’s co-CEO, said on November 3 that the exchange had replenished 98% of affected assets. Binance separately reported that approximately $2.85 billion had been frozen or intercepted. PBS described roughly $3 billion in affected assets as frozen, a similar figure rounded differently.
These figures are not interchangeable. Replenishing assets is different from freezing funds before they can move. Available reporting does not explain how the amounts relate, whether frozen funds were returned, or what valuation date was used. Teng said the remaining affected assets included less-liquid cryptocurrencies that could require additional purchases.
Binance said it would cover the full financial loss using corporate resources and reserves. The exchange also said it rebuilt affected wallet systems, replaced compromised devices, disabled associated credentials, strengthened wallet controls and expanded automated monitoring. It planned an independent cybersecurity review, but available reporting has not specified the reviewer, scope or publication timeline.
Binance also reported completing a Proof of Reserves verification covering ten cryptocurrencies, including Bitcoin, Ethereum, BNB and XRP. Such a verification covers specified holdings and customer balances within its scope. It does not establish that wallet infrastructure or internal access controls are secure. The reported details do not identify the verifier or provide enough information to assess the verification’s full scope.
Key questions and answers
-
How much was stolen from Binance?
The FBI said more than $6 billion was stolen on or about October 29, 2026. TRM estimated that approximately $6.36 billion moved from Binance wallets across ten blockchains.
-
What weaknesses did Haipo Yang identify?
He questioned the separation of development and production systems, safeguards against stolen credentials, and independent checks by transaction signers. Binance has not confirmed that these caused the theft.
-
How much had Binance restored?
Teng said 98% of affected assets had been replenished. Binance separately reported approximately $2.85 billion frozen or intercepted, but the figures have not been reconciled and may not mean the same thing.
-
Does Proof of Reserves show that Binance’s systems are secure?
No. It covers specified holdings and balances within the verification’s scope, not the security of employee devices, access controls or wallet systems.
The next test is independent verification
The reported attack involved familiar risks: compromised devices, deceptive recruitment and stolen credentials. Yang’s proposed weaknesses are plausible security concerns, but available information does not establish that Binance’s controls failed in the specific ways he described.
Binance’s planned independent review could clarify what happened and whether its changes address the risks. Its value will depend on the review’s scope and independence, and on whether Binance makes the findings and tests of its corrective measures public.
