Binance co-founder and co-Chief Executive Officer (CEO) Yi He has rejected a viral social media claim that the exchange’s $6.3 billion hot wallet breach began with an engineer’s romantic relationship with a North Korean operative. She also said blockchain investigator ZachXBT, whose name was attached to the story online, never made the allegation.
Yi He posted a reply on X at 16:58:50 Coordinated Universal Time (UTC) on November 1, 2026. In the reply, written in Chinese, she said: “This story is more dramatic, but it is not true. ZachXBT did not say that.”
What the Viral Post Claimed
Yi He was replying to a post published by AlphaWire at 14:03:49 UTC the same day. The post described “new, unverified allegations” that a Binance DevOps engineer had been romantically involved with a North Korean operative and had left a laptop unattended on the day of the attack. A DevOps (development and operations) engineer manages the systems used to build, deploy, and run a company’s software.
The AlphaWire post said the details were being attributed to ZachXBT online. It also stated that his original statement had not been independently verified. Yi He replied less than three hours later.
The same claim had also circulated in a post by the X account @doomerfied, which ended with ZachXBT’s name. That presented the allegations as if they came from the investigator himself, though the post linked to no investigation or evidence.
The Crypto Times Fact Check Reached the Same Conclusion
Earlier on November 1, The Crypto Times published a fact check of the Binance spy romance claim and found it false and misleading. The viral story combined two confirmed facts with personal details that no source has supported. The first fact is the compromised laptop Binance itself described. The second is the North Korean link drawn by blockchain analytics firms.
The Binance team told The Crypto Times: “This claim is completely false. It should be removed and reported as false information.”
What Binance Has Officially Said About the Laptop
Binance first published its Security Incident Update at 22:23 UTC on October 29, 2026, and updated it at 07:36 UTC on October 30. It states:
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.”
A hot wallet is a cryptocurrency wallet that stays connected to the internet so an exchange can process withdrawals. A service container is an isolated software environment that runs one part of an application. In later updates, the exchange said its investigation had found additional points of breach. None of Binance’s published updates mention a romantic relationship, an unattended device, or any personal conduct by the engineer.
What ZachXBT Actually Reported
ZachXBT is a pseudonymous on-chain investigator known for tracing stolen cryptocurrency. He posted his findings at 04:51:48 UTC on October 30. He reported that funds from the Binance hack and from the earlier Bitget exploit, worth about $388 million, ended up at the same address after passing through THORChain. THORChain is a cross-chain protocol that lets users swap native assets between different blockchains.
He wrote that this showed “the same actor is likely behind both incidents,” and noted that the Bitget attack had been attributed to TraderTraitor. His public posts on the incident do not mention a romance, an unattended laptop, or any specific Binance employee.
Who Investigators Say Was Behind the Attack
TRM Labs, a blockchain intelligence firm, attributed the attack to TraderTraitor “with high confidence.” It reported that about $6.36 billion was moved out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on October 29.
Chainalysis co-founder and CEO Jonathan Levin wrote on X that the hack, which Chainalysis valued at $6.4 billion, was “likely done by DPRK group TraderTraitor.” DPRK stands for the Democratic People’s Republic of Korea, North Korea’s official name.
On October 31, the Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of more than $6 billion from Binance “on or about October 29, 2026.” The FBI calls this activity TraderTraitor. Security researchers widely describe the group as part of North Korea’s state-backed Lazarus Group. The FBI worked with the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI) unit. Together, they observed the attackers converting stolen assets mainly into Ether (ETH).
These findings name the attacking group. None of them mentions a personal relationship involving a Binance employee. The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025, a case The Crypto Times compared with the Binance breach.
Where Binance’s Recovery Stands
On October 31, Binance said it had replenished 90% of the affected assets. The money came from its Secure Asset Fund for Users (SAFU), its Futures insurance fund, and its corporate treasury. The exchange said it was on track to resume withdrawals on November 1, and it has repeatedly said users will not bear the losses.
Binance has not yet published a full technical post-mortem. Until it does, the romance and unattended laptop story remains unsupported. As of publication, Binance, the FBI, TRM Labs, Chainalysis and ZachXBT have released no evidence supporting it.
Also Read: Binance Resumes Withdrawals After $6.3B Hack, Says 95% of Stolen Assets Now Covered