The Binance co-founder says compromised contacts can spread malware without knowing it, as four data breaches surface in a single day
Changpeng Zhao has a simple request for crypto users: stop clicking links in your email. That includes messages from your friends, your colleagues, and anyone else you would normally trust without a second thought.
The Binance co-founder posted the warning on X on October 28, 2026. His reasoning is the uncomfortable part. Trusted contacts may already have malware on their machines and not know it.
What CZ actually said
CZ, posting from his @cz_binance account at approximately 18:46 UTC, urged users to avoid email links and attachments. He did not limit the advice to messages from strangers.
The core logic is about how infections spread. If someone you know gets compromised, their account can send out malware-laden emails under their own name.
For crypto holders, the stakes are higher than a clogged inbox. A single bad click on a device that also holds exchange logins or wallet access can be costly.
Four breaches in one day
The timing was not random. The warning landed amid reports of four separate data breaches surfacing on the same day.
One of them involved Amplitude, a vendor used by Coinbase. That security incident exposed user contact details.
With a verified list of crypto exchange customers, an attacker can aim messages at people who are known to hold digital assets.
On the bright side, no user funds were reported lost in connection with the breaches mentioned on October 28.
A familiar message from a familiar messenger
This is not CZ’s first lecture on digital hygiene. He has built a habit of posting practical, user-focused security advice rather than only commenting on Binance-specific incidents.
In a May 2025 post, he pushed users toward password managers and hardware-based two-factor authentication.
Binance itself has a track record on this exact topic. In June 2025, a malware incident involved a password-protected ZIP file, the kind of attachment that can slip past basic email scanning.
The password-protected format matters. Locking the file can stop automated scanners from inspecting what is inside, while the recipient happily types in the password supplied in the same email.
CZ has also previously flagged PHP vulnerabilities that led to millions of attack attempts.
What this means for users and exchanges
For everyday users, the practical takeaway is behavioral. If an email asks you to click, download, or log in, the safer move is to go directly to the service through a bookmark or app you already trust.
CZ’s earlier recommendations still apply here. A password manager can refuse to autofill credentials on a lookalike site, and hardware two-factor keys add a physical step that a remote attacker cannot easily fake.
For exchanges, the pressure is on vendor oversight. The Amplitude incident shows that a platform’s security posture extends to every partner that touches customer data.
