CZ Urges Account Checks After 4 Data-Breach Reports

What Zhao asked users to change

Odaily attributed the comments to Zhao's post on X. Its report named Coinbase service provider Amplitude, South Korean crypto exchange Bithumb, and securities firms Mirae Asset and Daishin Securities among the four reported incidents. Those are the incidents Zhao was discussing; the count is attributed to him. The report says the Amplitude incident affected some Coinbase customers' contact information and that their funds were unaffected. Odaily's incident context.

PANews described the same set of reports and said Zhao warned about phishing, SIM swapping and social engineering using leaked exchange information. The two outlets point to the same speaker. Their articles do not establish a shared attacker, a common technical cause, or an independently audited total of affected people. PANews' security report.

For an exchange user, the useful part of the response is its specificity. Zhao's reported suggestions extend from the email used to register an account to the permissions left on an old API key. The checks below turn those suggestions into a review you can carry out on your own accounts. They describe what to inspect, without assuming a particular exchange offers every control.

Start with the email address and password

PANews reports that Zhao recommended a separate email alias for each exchange, a dedicated phone number, and providing only necessary information. It also reports his advice to use a password manager to generate unique, long passwords. Odaily likewise mentions separate exchange email addresses and strong passwords. PANews on contact details and passwords.

A practical way to act on that advice is to make an inventory by exchange. Record which email address you use, whether you have reused the password elsewhere, and which authentication method you currently rely on. Keep the inventory private and leave actual passwords out of a shared document. The purpose is to identify the accounts that need attention, rather than assemble a file containing everything needed to access them.

If you discover password reuse, replace the exchange password with a unique one generated by your password manager. Review the other account that used it as a separate task. Do not infer from a contact-information report that a password was leaked; the reason to replace a reused password is the reuse you have identified in your own inventory.

Treat an email change carefully. Before starting, read the instructions shown by your exchange and confirm that you can access both the current account and the intended replacement address. Follow the account's instructions for recovery steps and any waiting period before proceeding.

Review the method that approves a login

Odaily says Zhao advised prioritizing hardware security keys, passkeys or an authenticator instead of relying on SMS-based two-factor authentication. PANews also reports his preference for hardware keys or passkeys and his warning about SMS and SIM swapping. Odaily on authentication.

SponsoredBinance

Partner rebate share25%Up to

Check regional eligibility and account terms

✓Code applied automatically by the sign-up link: 11350287

Sign up on Binance →Code11350287Copied

Open the security settings in the exchange account you already use and identify the method actually enabled. Write down whether SMS is your only second factor. If the account offers another method, follow its instructions and review the recovery information before making the change. The names of controls and the supported choices should come from your account's own screen.

For example, consider a user who believes they enabled an authenticator months ago but has continued approving logins by text message. The next useful action is to inspect the current settings and verify which factor is active.

Avoid changing several access settings at once without checking the result. After each change, verify that the account shows the intended method and that you understand the next login step. Keep recovery details private. A security review should leave you with a working access method you can identify, along with a record of what you changed.

Check the destinations that can receive withdrawals

Zhao's reported recommendations included withdrawal address whitelists and anti-phishing codes, according to Odaily. PANews also mentions withdrawal time locks. Neither report gives a universal waiting period, a venue-by-venue feature list or instructions for a particular account tier. PANews on withdrawal controls.

Use that advice to inspect the withdrawal controls already available in your account. Review any saved destination and ask whether you still use it and recognize it. Where the account provides an address whitelist, read how that control applies before changing it. Where it provides a time lock, check the actual duration and conditions on the exchange itself.

A hypothetical example makes the review concrete: a saved withdrawal address might have belonged to a wallet you stopped using. Compare it with your own records before deciding whether to keep it. Do the same for an address you recognize only by an old nickname. The objective is to know why each approved destination is present.

If you choose to enable an anti-phishing code, use the exchange's own setup instructions. Keep the code private and check how the exchange says it appears in its messages. The reports support Zhao's recommendation to use this control; they do not establish the delivery channels or exact appearance for every exchange.

Give old sessions and API keys their own review

Odaily reports that Zhao recommended checking login sessions and API-key permissions regularly, and revoking unnecessary API keys after a breach. PANews adds active-session revocation and limiting key permissions to its account of his advice. Odaily on sessions and API access.

For a reader who has used a trading app or another account-connected tool, start by identifying each key listed in the exchange account. Record its label, the service you intended to use it with, and the permissions the exchange currently displays. If you cannot explain why a key is still needed, investigate that entry before leaving it active.

Where you still use a key, compare its current permissions with the task you want the connected service to perform. Follow Zhao's reported recommendation to limit permissions, using the choices the exchange provides. Do not add a new permission merely to clear an error in an unrelated tool during this security check.

Review sessions separately. Compare each displayed session with your own devices and recent use. If an entry is unfamiliar, use the exchange's account-security instructions to respond. The reports do not say that every unfamiliar-looking entry represents an attacker. Keep a note of what you find so that you can describe it accurately if you need support.

Respond to a breach notice without following a stranger's instructions

PANews reports that Zhao recommended changing passwords, checking whether email was compromised, revoking API keys and sessions, and reviewing recent withdrawals and security settings when an exchange announces a breach. Odaily also reports his warning about people impersonating customer support. PANews on responding to a notice.

Use the account and support route you already know to review a notice. Separate the notice's stated scope from any request sent by someone claiming to help. As an example, a message could refer to a real news report while asking you to approve a transfer. Treat that as an instruction to verify independently; a reference to this day's breach reports does not authenticate its sender.

When checking withdrawals, compare the records with transactions you actually initiated. If you find a withdrawal you do not recognize, preserve its displayed details and contact the exchange through its established support route. Avoid posting a full account screenshot while asking strangers to diagnose the situation. That recommendation follows the reported warnings about impersonation and exposing holdings.

Zhao also warned about physical risks when home addresses and asset information are exposed, according to both outlets. PANews says he advised against publicly disclosing holdings or linking large assets to a home address. Apply that advice to the material you share while seeking help: describe the problem without publishing your balance or residential details. Odaily on personal-information risks.

Questions the reports answer

Did Zhao say four exchanges were breached?

No. The reported list includes Amplitude, Bithumb, Mirae Asset and Daishin Securities. It spans an exchange service provider, a crypto exchange and securities firms. The figure is four reported incidents, attributed to Zhao. Odaily's wording.

Do these reports say Coinbase customers lost funds?

They say funds were unaffected in the Amplitude-related incident. They do not supply a loss figure for the four incidents taken together. Keep that scope when discussing the story. PANews' incident summary.

Is this a new Binance security requirement?

The sources report advice from Binance founder CZ. They do not announce a new Binance requirement, mandatory account migration or authentication deadline. For venue background, see our Binance profile; use your actual account settings for the security review.

What information is still missing?

The two reports do not provide full forensic reports for all four incidents, a combined affected-user total or an independently verified count of account takeovers. Both attribute the advice to Zhao's same post. For now, the actionable information is the reported list of controls to inspect in an existing exchange account.