Binance co-founder Changpeng Zhao has warned cryptocurrency users against clicking links or downloading attachments from emails, even when the messages appear to come from friends, colleagues or other trusted contacts.
In a post on October 28, 2026, Zhao, widely known as CZ, cautioned that a sender’s device could already be infected with malware without their knowledge, allowing attackers to distribute malicious content through seemingly legitimate messages.
The warning came as reports of multiple data breaches surfaced across the cryptocurrency and financial sectors. One incident involved Amplitude, a third-party analytics provider used by Coinbase, which exposed contact information belonging to a small subset of the exchange’s customers. Coinbase said its own systems had not been breached and that customer funds remained safe, but warned that affected users could face phishing and social engineering attempts. <Cite refs={[“turn281602search0″,”turn281602search1”]}/>
Other reported incidents involved South Korean cryptocurrency platform Bithumb and financial firms Daishin Securities and Mirae Asset. The disclosures highlighted how personal information exposed through companies and third-party providers can give criminals the details they need to create convincing scams targeting investors.
For cryptocurrency holders, the danger extends beyond traditional email spam. Attackers can use leaked contact details to impersonate exchange support teams, send fake account-security alerts, or direct victims to fraudulent websites designed to steal login credentials and wallet recovery phrases. A message may appear genuine because it uses familiar names, references a real service or arrives through a compromised account belonging to someone the recipient knows.
Security experts recommend avoiding unexpected links and attachments, even when they come from familiar senders. Instead of following a link in an email, users should open the official exchange app or type the service’s known website address directly into their browser. Anyone receiving an unusual request from a friend or colleague should verify it through a separate communication channel.
Users should also enable phishing-resistant authentication wherever possible, such as hardware security keys or supported passkeys, rather than relying solely on SMS verification codes. Unique passwords stored in a password manager can reduce the impact of credential theft, while separate email addresses for financial and cryptocurrency accounts can help limit the exposure caused by future data leaks.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Crypto holders should never share passwords, authentication codes or wallet seed phrases with anyone claiming to provide technical support. Keeping recovery phrases offline, updating devices regularly, reviewing active account sessions and restricting withdrawals to approved addresses where supported can provide additional protection.
