Four Leaks in One Day, and CZ's Security Advice Is the Bare Minimum

Four firms reported crypto data leaks on the same day this week, and Changpeng Zhao answered with a checklist instead of a panic post.

His advice: use email aliases, turn on passkeys, and set a SIM lock with your carrier. Nothing exotic. That's the point.

The day it all landed

The reports came in a cluster. Two crypto exchanges and two Korean finance firms, all disclosing some form of exposure inside roughly the same 24-hour window. Based on what's been published, the leaked fields were the boring ones: names, email addresses, phone numbers.

No funds moved. Every case reported so far says customer balances stayed intact.

But that's the wrong thing to celebrate. A leaked email tied to a verified exchange account isn't a nothing. It's a lead. Scammers know which addresses belong to people with balances, and they know those people already cleared KYC, which means they're reachable, patient, and often holding more than they'd admit on a forum.

CZ posted his playbook once the reports piled up. Email aliases so your real inbox never sits in an exchange's database. Passkeys so there's no password to phish and no code to intercept. SIM locks so nobody walks into a carrier store with a fake ID and walks out with your phone number.

What actually broke

Nothing broke at the protocol level. That's the frustrating part.

The failures here are boring operational ones, and the cost lands on users. A leak costs the company a disclosure post and a few news cycles. It costs the user weeks of re-reading every "urgent security notice" email, because one of them might be real.

The question worth asking: why is a carrier-side port-out lock, a feature that's existed for years, still something most people learn about from a tweet?

I'm not entirely convinced CZ's list moves the needle on its own. Advice posts are cheap. Passkey support isn't. The four firms will say the right things about hardening their systems, and then most of them will keep the login flow they had last month, because changing it means support tickets.

To be fair, the incentives are real. CZ runs an exchange. A safer user base is a cheaper user base, fewer account takeovers, fewer refunds, less damage control. There's self-interest baked into the advice, and the advice is still correct.

What to watch

The next four to six weeks are the window. Leaked contact lists get weaponized fast, usually within days, then again in a second wave once those lists get resold. If you had an account at any of the four firms, expect the phishing to get better written, not worse.

Watch for follow-up disclosures with actual user counts, since the first statement rarely includes them. Watch Korean privacy regulators too, who've historically pushed for firmer breach reporting timelines than their US counterparts. And watch whether any of the four firms publishes passkey rollout dates rather than a vague note about taking security seriously.

History suggests otherwise on that last one.

Here's a threshold worth tracking: count how many of the four have passkeys live by the end of next quarter. My guess is one.

The honest takeaway is that SAFU is a personal practice now, not a platform promise. Set the alias, add the passkey, call your carrier and ask for a port-out PIN. It takes 20 minutes. Time will tell, though, whether the industry decides to make any of that the default.