Yang Haipo, founder and CEO of mining pool ViaBTC and crypto exchange CoinEx, commented on Binance’s security incident in a post on X, saying the case exposed at least three failures that could have been avoided. The missing piece, he said, was not advanced technology but discipline.
Three issues raised by Yang Haipo
First, Yang said development and operations environments were not fully separated. Personnel with access to the production environment should use dedicated devices and should not install third-party software. Coding, chatting, and web browsing, he said, should be handled on a different machine.
Second, he said the operations system lacked effective two-factor verification, with a single key able to operate production services. Once that key is leaked, an attacker can obtain full production access.
He said production operations could be handled through a browser-based method similar to AWS Session Manager, with a hardware security key used as the second factor, so that the leakage of a single credential would not amount to a full breach.
Third, Yang said the MPC multisig arrangement existed in name only because signers did not carry out substantive and independent verification of transactions. If one node is compromised, he said, the whole mechanism can fail, making it no different from a single-signature setup.
He added that multisig works only when signers do not trust one another, independently verify the transaction itself, and do not simply trust upstream requests.
Binance previously released preliminary findings
On Nov. 3, Binance published preliminary findings on the Oct. 29 security incident. The exchange said about $63.4 billion in digital assets were affected. As of the update, around $28.5 billion had been frozen or intercepted, and 98% of the affected tokens had been replenished.
According to the report, the attacker obtained unauthorized access to an internal wallet signing service and used Ethereum EIP-7702 to authorize hot wallets. Because the hot wallets used multi-party computation, the related authorization could not be revoked immediately with a single private key.
Binance also cited information from the FBI saying North Korea was responsible for the incident.
