Binance founder Changpeng Zhao (CZ) has issued a security playbook after four separate data leaks targeted Coinbase, Bithumb, Mirae Asset Global Investments, and Daishin Securities on October 28, 2026. While user funds remained safe across all reported incidents, leaked customer details including names, emails, and phone numbers have heightened risks of phishing, SIM swaps, and social engineering attacks.
Four Data Leaks Hit Crypto and Korean Financial Firms
The wave of security exposures affected major platforms across both digital assets and traditional finance:
- Coinbase: Analytics vendor Amplitude exposed contact data for certain users, though customer funds were not impacted.
- Bithumb: The South Korean crypto exchange discovered on October 27, 2026, that an unauthorized outsider accessed its internal mobile groupware system.
- Daishin Securities: The South Korean firm confirmed a data exposure impacting 38,490 customers.
- Mirae Asset Global Investments: Attackers accessed names belonging to specific employees.
Similar to prior customer data exposure incidents, these leaks exposed personal identifiers rather than private keys. The breach at Bithumb follows a broader series of security incidents targeting South Korean financial institutions, which began at Shinhan Bank in late September 2026.
CZ Outlines Playbook to Maintain SAFU Status
In response to the breaches, Zhao urged crypto investors to adopt proactive security measures to stay SAFU—a term originating as a 2018 meme before Binance created its Secure Asset Fund for Users.
First, Zhao advised setting up unique email aliases for each crypto exchange. This isolates potential breaches and immediately reveals which platform exposed user details. Second, Zhao recommended abandoning SMS-based two-factor authentication (2FA) in favor of hardware keys, passkeys, or authenticator applications, noting that leaked phone numbers frequently facilitate SIM swapping attacks.
Furthermore, Zhao warned users to treat any unsolicited contact regarding account security or refunds as a scam, even if callers possess exact account details. Highlighting this risk, recent Passport wallet phishing emails contained real physical home addresses of recipients, prompting Zhao to advise affected users to change exposed email addresses immediately.
Why It Matters
The concentration of data leaks across crypto and traditional finance highlights how personal data harvesting poses a more immediate threat to user funds than direct cryptographic breaches. Physical and social engineering risks are compounding rapidly, as evidenced by an estimated $30 million stolen through wrench attacks in the first half of 2026. As attackers increasingly pair leaked contact details with wallet balances, individual security hygiene—such as strict email compartmentalization and non-SMS authentication—is becoming the primary line of defense.
