Binance co-founder Changpeng Zhao, known as CZ, has warned cryptocurrency users to strengthen their account security after four data leak reports involving financial firms. The incidents affected Coinbase’s analytics provider Amplitude, South Korean crypto exchange Bithumb, Mirae Asset Global Investments and Daishin Securities.
In a post on X on October 28, CZ warned that leaked personal information could expose users to phishing, SIM-swapping attacks and social engineering. He also shared practical steps to help crypto users reduce these risks.
The reports highlight a growing concern for the crypto industry. Even when hackers do not access customer funds, exposed personal information can help criminals target account holders.
Four Data Leak Reports Involve Crypto and Financial Firms
The first incident involved Coinbase’s third-party analytics provider, Amplitude. Coinbase said the security incident exposed contact information belonging to a small subset of its customers. However, the exchange found no evidence that attackers accessed its own systems and said customer funds remained safe. The company did not disclose the exact number of affected users.
Meanwhile, Bithumb reported unauthorised access to its internal mobile groupware system on October 27. The exchange is investigating the extent of the exposure, including whether customer information was affected.
Two South Korean financial firms also reported separate incidents.
Mirae Asset Global Investments confirmed unauthorised access to some internal web systems. However, the company said it had found no evidence that general customers’ personal or credit information was compromised.
Daishin Securities reported the clearest confirmed customer impact. The brokerage said personal information belonging to 38,490 customers had been exposed. The affected data included names, email addresses and mobile phone numbers.
Although the incidents occurred around the same time, investigators have not established that all four cases are connected.
CZ Warns Crypto Users About Phishing and SIM Swapping
CZ said criminals often exploit leaked information to make fraudulent messages appear legitimate. For example, a scammer who knows someone uses a particular crypto exchange may send a fake security alert to steal their login details.
Similarly, SIM swapping allows criminals to take control of a victim’s phone number. They may then use it to intercept text-message verification codes and attempt to access online accounts.
CZ advised users to limit the personal information they share with crypto platforms. He also recommended using a unique email address or alias for each exchange. This approach can help users identify which service may have exposed their information.
In addition, he encouraged users to consider a dedicated phone number for crypto accounts where possible.
CZ Recommends Stronger Crypto Account Security
CZ outlined several steps users can take to improve their security.
First, he advised users to avoid SMS-based two-factor authentication when stronger options are available. Authenticator apps, passkeys and hardware security keys can provide alternatives.
He also recommended enabling withdrawal address whitelisting and withdrawal time locks where supported. These features can help users restrict where funds can be sent and provide additional time to respond to suspicious activity.
Users should also review active login sessions and API keys regularly. Removing unfamiliar sessions and disabling unused API permissions can reduce the risk of unauthorised access.
Finally, CZ warned users against sharing details of their crypto holdings publicly. He noted that linking personal addresses to information about cryptocurrency holdings can expose people to extortion and physical attacks.
You may also like: CZ Challenges Bank of America Penalty, Reignites Debate Over Crypto Enforcement
What Crypto Users Should Do After a Data Leak
A data leak does not automatically mean that someone has accessed a user’s crypto wallet or stolen their funds. However, exposed contact information can make targeted scams more convincing.
Users should therefore take several precautions.
- Change reused passwords: Use a unique, strong password for every exchange and email account.
- Strengthen two-factor authentication: Choose passkeys, hardware security keys or authenticator apps where available.
- Review account activity: Check login sessions, API keys and recent withdrawals for suspicious activity.
- Secure your phone number: Ask your mobile provider about SIM-swap protection and number-porting locks.
- Ignore unsolicited support messages: Never share passwords, verification codes or wallet recovery phrases with someone who contacts you unexpectedly.
Users should also contact an exchange through its official website or app if they suspect their account has been targeted.
The four incidents serve as a reminder that crypto security extends beyond protecting private keys. Companies must secure customer data, while users should limit their exposure and remain alert to suspicious messages. As CZ’s warning suggests, stronger personal security can help reduce the risks even when a data leak occurs.
