A major security breach at Binance has revealed critical operational weaknesses and resulted in an estimated loss of approximately $6.34 billion, according to a November 3 report and commentary from industry figures including CoinEx founder Haipo Yang.
The attackers reportedly targeted Binance engineers for months before the October 29 theft. Using stolen credentials, they accessed the exchange’s internal wallet signing service, enabling transfers outside the normal withdrawal process. The report describes three affected engineers anonymously as A, B, and C. In June, Engineer A downloaded a tampered Homebrew installer while setting up an AI coding tool; Binance replaced the device and rotated credentials after detecting the breach. In September, Engineer B was targeted through a fake job interview and downloaded a coding assignment containing a malicious repository. By October 20, stolen credentials were used to facilitate the attack.
Haipo Yang, founder of CoinEx, said the incident exposed three operational flaws: the lack of strict isolation between development and production environments, the absence of robust two-factor authentication (2FA), and an ineffective multi-signature (MPC) setup that failed to ensure independent verification among signers. Yang noted that a single leaked credential could lead to a full compromise under these conditions.
The breach raises broader concerns about security standards across the cryptocurrency industry. Binance, one of the largest crypto exchanges globally, faces potential regulatory scrutiny and user trust risks. Traders are watching for Binance’s response, including improved security measures and transparency, which could influence confidence in the exchange and the wider market.
