Zhao Details SAFU Steps as Four Firms Hit by Data Leaks

Changpeng Zhao (CZ), the founder of Binance, laid out a safety checklist after two major crypto exchanges and two Korean financial houses each reported data breaches on the same day. He cautioned that every such leak paves the way for phishing, SIM swaps and social engineering.

In each incident disclosed to date, no funds have been lost. Even so, the exposed names, email addresses and phone numbers give scammers a ready-made directory of exchange users whose holdings make them attractive targets.

Zhao’s Playbook for Staying SAFU After a Data Leak

4 data leaks reported today:

1. Coinbase's vendor Amplitude exposed some users’ contact data (funds unaffected).
2. Bithumb (Korea) had user data leaks.

In TradFi, two securities firms in Korea leaked data:
3. Mirae Asset
4. Daishin Securities

You can't prevent a leak, but…

— CZ 🔶 BNB (@cz_binance) October 28, 2026

The term SAFU grew out of a 2018 crypto meme in which the word “safe” was misspelled. Binance later adopted it as the name of its emergency reserve, the Secure Asset Fund for Users.

Zhao’s first recommendation was that each exchange account be tied to a distinct email alias. If a breach occurs, the damage stays contained to that alias, and users can identify exactly which platform was responsible.

The Binance founder also warned against relying on SMS-based two-factor authentication. Hardware keys, passkeys or authenticator apps are the better choice, he said, because a leaked phone number is the usual gateway to a SIM swap.

Anyone who contacts you about security problems or refunds should be assumed to be a scammer, according to Zhao, even if that person already knows details about your account. Passport wallet phishing emails recently sent to users, for instance, included their actual home addresses.

After another user mentioned that phishing messages kept showing up, Zhao’s advice was to switch the address without delay.

What Raises the Stakes in the Latest Breaches

The Coinbase exposure, Zhao said, came through Amplitude, a US analytics vendor. Bithumb, meanwhile, discovered on October 27 that an outsider had gained access to its internal mobile groupware system, according to the Korea Times.

On the traditional finance side, Daishin Securities confirmed a breach affecting 38,490 customers. Mirae Asset Global Investments, by contrast, said the intruders could see only some employee names.

The Bithumb incident adds a crypto-related breach to the string of attacks against Korean financial firms that started at Shinhan Bank in late September. The suspected perpetrator of earlier Korean bank breaches reportedly queried an AI tool about where to sell stolen data.

There is also a rising physical danger. Combining home addresses with holdings data has enabled so-called wrench attacks, which netted criminals an estimated $30 million during the first six months of 2026.

Zhao said last week that phishing fed by leaked data poses a greater threat than any AI attack aimed at Bitcoin’s cryptography. Within days, four new breaches gave scammers a fresh trove of contact details spanning both crypto and traditional finance.