CoinEx's Haipo Yang pins Binance breach on three preventable security gaps

Haipo Yang, the founder of CoinEx and ViaBTC, says Binance's Oct. 29 security breach laid bare three weaknesses that were entirely avoidable. His critique lands on production access, credential sprawl and wallet transaction checks.

Lapse one: who touches production. Yang argues that employees with production permissions should work from dedicated machines stripped of third-party software, with coding, messaging and web browsing confined to separate devices. Mixing those worlds, in his view, hands an attacker an easy path inward.

Lapse two: too much power in one key. Yang alleged a single credential could operate production services, and proposed demanding a hardware security key alongside browser-based access, similar to how Amazon Web Services handles its Session Manager. One password shouldn't open the whole building.

Lapse three: signing without looking. Yang zeroed in on multiparty computation signing, saying signers did not independently inspect transactions before approving them. That setup, he argued, means compromising one signing node could quietly unravel the safeguards the whole scheme is built on.

Here's what actually happened. An attacker slipped into an internal wallet-signing service and used Ethereum's EIP-7702 mechanism to hand an attacker-controlled smart contract partial execution rights over a hot wallet, according to tokenpost. Because the wallet relied on MPC, the authorization couldn't be yanked back instantly with a single private key.

The damage estimates were still moving. Preliminary figures put affected digital assets at roughly $6.34 billion, subject to reconciliation and market-price swings, per tokenpost. About $2.85 billion had been frozen or intercepted as of the Nov. 3 update, and Binance had replenished 98% of affected token assets as of Oct. 31.