Changpeng Zhao updates guidance on protecting crypto assets

what happened

RBC Crypto reports that a mass breach of Ledger hardware wallets in October 2026 revived concerns about the security of self-custodied crypto assets. Following the first reports on October 9, users began taking their devices apart and posting videos of alleged malicious modules. Changpeng Zhao described the incident as most likely a localized supply-chain attack involving one vendor, in which a small number of customers may have bought counterfeit or modified Ledger devices.

In an updated guide reduced to key principles, the Binance founder says security measures should match both the value of the assets and the owner’s technical expertise. For self-custody, he highlights a dedicated computer, a separate mobile phone and a hardware wallet. Software should be installed only from official sources, devices should be checked for malicious code, data should be encrypted and physical control over the equipment should be maintained. Recipient addresses should be verified directly on the hardware wallet’s screen.

Zhao also focuses on the seed phrase, a sequence of 12, 18 or 24 words. He recommends keeping several backups and considers paper records, metal plates and encrypted USB drives, while noting the drawbacks of each method. He gives a categorical warning against photographs or screenshots that could be synchronized with cloud accounts. For inheritance planning, he mentions a dead man’s switch, but advises users to study and test such a service before relying on it.

For customers of Binance, Bybit and other centralized exchanges, account security remains the user’s responsibility. The recommendations include a separate email address with 2FA, unique passwords, hardware security keys, avoiding SMS authentication, withdrawal address whitelists, API-key protection, device locks and accessing exchange websites through trusted bookmarks or by entering the address manually.

why it matters

The episode highlights that crypto-security risks extend beyond the wallet itself to supply chains, backups, phishing, devices and inheritance arrangements. The choice between self-custody and a centralized exchange therefore involves different categories of operational and security risk.

instruments