CoinEx Founder Says Binance Breach Exposed Three Avoidable Lapses

Haipo Yang, founder of CoinEx and ViaBTC, said Binance’s Oct. 29 breach exposed three security weaknesses he believes could have been avoided, including gaps in production access and wallet transaction checks.

Yang said employees with production permissions should use dedicated computers without third-party software, while coding, messaging and web browsing take place on separate devices. He also alleged that one credential could operate production services and proposed requiring a hardware security key alongside browser-based access similar to Amazon Web Services Session Manager.

Yang’s third criticism concerned multiparty computation (MPC) signing. He said signers did not independently inspect transactions before approval and argued that compromising one signing node could undermine the safeguards.

An attacker gained unauthorized access to an internal wallet-signing service and used Ethereum’s EIP-7702 mechanism to give an attacker-controlled smart contract partial execution rights over a hot wallet. The wallet’s MPC setup meant the authorization could not be revoked immediately with a single private key.

The initial findings on Binance’s breach put affected digital assets at about $6.34 billion in preliminary estimates subject to reconciliation and market-price changes. About $2.85 billion had been frozen or intercepted as of the Nov. 3 update. Binance had replenished 98% of affected token assets as of Oct. 31.