Changpeng Zhao on Recent Crypto Hacks

Changpeng Zhao (CZ), the founder of the world’s largest cryptocurrency exchange Binance, addressed the recent wave of hacks impacting major crypto platforms. In a detailed explanation, CZ outlined significant vulnerabilities and provided insights into security practices for both exchanges and users.

CZ identified a disturbing trend in recent attacks affecting various exchanges, including ByBit, Phemex, and WazirX. He reported that hackers successfully stole substantial amounts of cryptocurrency from multi-signature cold storage solutions.

In ByBit’s case, hackers manipulated the front-end interface to display legitimate transactions while a different transaction was being signed. Although less familiar with the specifics of the other incidents, he noted that they appeared to follow similar patterns of attack.

What’s even more alarming, CZ pointed out, is that these exchanges use different multi-signature solution providers, implying that the breaches were not confined to a single vulnerability. The hacking group identified, known as the Lazarus Group, is notorious for its advanced cyber capabilities. It remains uncertain if the breaches were due to compromised signing devices, server-side infiltrations, or both.

In light of ongoing security concerns, CZ reaffirmed Binance’s long-standing security principles. He defended the recommendation to halt all withdrawals after a security breach as a standard precautionary measure. Despite criticism, he argued that these actions allow exchanges to investigate the breach thoroughly, understand attack vectors, and ensure security before operations resume.

He referred to Binance’s experience in 2019 when it suffered a $40 million hack. The exchange suspended withdrawals for a week, resulting in more deposits than withdrawals when services resumed, contrary to initial fears. CZ emphasized that each situation is unique, and the decision to halt operations should be contingent on the available information.

CZ commended ByBit CEO Ben Zhou for his transparency and composure during the security incident, contrasting it with what he perceived as a “less transparent” approach from leaders of other exchanges like WazirX and the now-defunct FTX. While he refrained from commenting on WazirX due to ongoing legal matters, he firmly characterized FTX’s collapse as fraud rather than a security failure.

> This is not investment advice.