CoinEx founder Yang Haipo: The theft at Binance exposed three issues that could have been avoided, including the incomplete isolation of its development and operation environment

ViaBTC mining pool and CoinEx trading platform founder and CEO Yang Haipo posted on X, commenting on the Binance security incident. He stated that the incident exposed at least three avoidable mistakes, which do not require complex technology; what is lacking is discipline.

Yang Haipo pointed out that first, the development and operation environments were not completely isolated. Personnel with production environment permissions should use dedicated devices and not install third-party software; coding, chatting, and web browsing should be done on another device. Second, the operation and maintenance system lacked effective dual verification. A single key could operate production services, and once the key was leaked, attackers could gain full production access. He believes that production operations could be conducted in a manner similar to AWS browser-based Session Manager, using hardware security keys as a second factor to prevent a single credential leak from constituting a breach. Third, MPC multi-signature is merely nominal; the signers did not perform substantial independent verification of the transactions. Compromising one node could render the entire mechanism ineffective, resulting in the same effect as a single signature. Multi-signature is only effective when the signers do not trust each other, independently verify the transaction itself, rather than trusting upstream requests.

On November 3, Binance released preliminary investigation results regarding the security incident on October 29. Binance stated that approximately $6.34 billion in digital assets were affected, and as of the update, about $2.85 billion had been frozen or intercepted, with 98% of the affected tokens having been replenished. The report indicated that attackers gained unauthorized access to the internal wallet signature service and exploited Ethereum EIP-7702 to authorize the hot wallet; due to the hot wallet using multi-party computation, it could not immediately revoke the relevant authorization with a single private key. Binance cited information from the FBI stating that North Korea is responsible for this incident.