Changpeng Zhao’s claim that banks may be more exposed to cyberattacks than crypto exchanges is an opinion, not a demonstrated security comparison. The extraordinary Binance breach cited alongside it, including a reported $6.3 billion theft, cannot be treated as established without verifiable, dated evidence.
- The alleged breach is dated October 29, 2026, but the interview date and incident documentation are unspecified.
- The reported attack details and attribution to North Korea’s TraderTraitor group remain unverified here.
- CZ’s comparison between banks and exchanges is not supported by comparative security data.
- Claims about frozen funds, replenishment and reserves need clearer figures and documentation.
A striking claim with an unresolved timeline
In an interview identified as being with CoinDesk, Binance founder Changpeng Zhao, known as CZ, reportedly argued that exchanges attract attackers because they hold valuable assets that can be moved quickly, while banks face greater overall risk.
“If a crypto exchange can be hacked, banks are in a worse position, in my opinion, ”
That qualification matters: this is CZ’s opinion, not a conclusion supported by comparative data. No common measure of bank and exchange security, or comparison of their breach rates and losses, is provided.
The claim is paired with an alleged Binance hot-wallet theft of roughly $6.3 billion. A hot wallet is connected to the internet so an exchange can process transactions. That convenience also makes its security especially consequential. The reported incident is dated October 29, 2026, but the interview date and a verifiable incident record are not specified. The date and scale therefore cannot be reconciled or presented as confirmed facts.
What the alleged attack involved
The reported account describes a months-long social-engineering campaign involving fake job interviews and poisoned software downloads. It says the attackers compromised a Binance DevOps engineer’s laptop, then accessed internal systems. DevOps refers to work that connects software development with the systems used to run and maintain software.
It also claims that attackers used an AI tool and exploited Ethereum’s EIP-7702 feature to control a key hot wallet without exposing private keys. EIP-7702 lets a standard Ethereum account temporarily delegate certain behavior to code. The account does not explain the feature’s alleged role, and the information provided is not enough to call it a vulnerability.
Blockchain firms and the FBI are said to have attributed the heist to North Korea’s TraderTraitor group. The firms and the evidence behind that attribution are not identified, and no public FBI statement is specified. The attribution, like the technical account of the attack, needs independent verification.
Freezing funds is not the same as recovering them
Binance reportedly paused withdrawals while deposits continued, and industry partners reportedly froze nearly $3 billion of the stolen assets. Binance was also said to have pledged to cover user losses using its reserves and its SAFU fund, its named user-protection fund.
Binance later reportedly said it had replenished most of the missing crypto and restored full proof-of-reserves coverage. Proof of reserves can show assets held against stated reserves, but it does not, by itself, establish an exchange’s full liabilities or overall security. The exchange has also faced other public disputes, including a Binance and OKX feud.
The distinctions matter. Frozen funds are not necessarily recovered, and replenished funds are not necessarily the stolen assets returned. The reported figures do not say how much was ultimately recovered, what “most” means, or when the replenishment occurred. Without a breakdown and supporting documentation, it is not possible to assess the final losses or independently confirm that users were made whole. These are recurring concerns in crypto exchange security.
CZ also reportedly cited a $2.8 billion net inflow to Binance over the preceding 24 hours. A net inflow means more funds entered the exchange than left during that period. The date, data provider and calculation details are unspecified, so the figure cannot, by itself, establish customer confidence or verify the exchange’s financial position.
Key questions and answers
-
Is the reported $6.3 billion Binance theft confirmed?
Not based on the details provided. The stated date is October 29, 2026, but no dated incident documentation is identified to establish the event or its scale.
-
What was the alleged route into Binance’s systems?
The account describes fake job interviews and poisoned downloads that compromised a DevOps engineer’s laptop, followed by access to internal systems. Those details have not been independently substantiated here.
-
Does the information show that banks are less secure than crypto exchanges?
No. CZ’s statement is an opinion, and no comparative security data is provided.
-
Were all the reported stolen funds recovered?
That has not been established. Partners reportedly froze nearly $3 billion, and Binance reportedly said it replenished most of the missing crypto, but no final recovery figure is given.
Security claims need evidence
Banks face cyber threats, and crypto exchanges have their own concentrated risks: online wallets, fast-moving assets and systems that can connect customer funds to complex infrastructure. But claiming one sector is “in a worse position” requires comparable evidence, not confidence from a prominent founder.
If the reported attack details are substantiated, the alleged use of social engineering would reinforce a familiar lesson: security depends on people, devices and internal access as well as wallet technology. For now, the scale, timeline, attribution and recovery claims need clear documentation. In crypto, transparency after a crisis is not a victory lap. It is part of accountability.
