CZ Tells Musk to Stop Trolling Binance After $6.3B Hack
Key Takeaways
- •Partners froze approximately $3 billion in assets connected to the Binance security incident.
- •Binance’s preliminary investigation identified a compromised DevOps engineer laptop as a possible access point for unauthorized withdrawals.
- •The exchange said it had found no evidence that wallet private keys were leaked and promised a fuller technical post-mortem after verification.
- •Binance plans to use SAFU and company funds to cover losses, while Yi He said annual revenue was sufficient without selling SpaceX-linked shares.
- •Users are awaiting the reopening of withdrawals, updated proof-of-reserves information and confirmation that frozen assets remain secured.

Binance co-founder Changpeng “CZ” Zhao publicly urged Elon Musk to stop mocking the exchange after Binance estimated that an October 30 security incident had caused an impact of nearly $6.3 billion. The dispute began with Musk’s emojis and “Everyday is Zeroday” quip, then expanded into a public discussion of Binance’s reserves, frozen funds and ability to absorb the losses.
CZ pointed to SpaceX-linked shares that he values at more than $1 billion. Binance co-CEO Yi He later said the company’s annual revenue was sufficient to cover the remaining losses without selling those shares.
The exchange’s official security incident update said partners had frozen approximately $3 billion on-chain. Binance’s preliminary findings pointed to a compromised laptop belonging to a DevOps engineer. The access may have enabled an attacker to reach a service container and submit unauthorized withdrawals.
Binance said it had found no evidence that wallet private keys were leaked. It said a more detailed technical post-mortem would be published after the findings were verified.
The company pledged to cover losses through its Secure Asset Fund for Users, known as SAFU — the emergency reserve Binance created in 2018 and funds with a portion of trading fees — and company funds. It also said user funds were safe and that it would publish an updated Proof of Reserves after remediation. Proof-of-reserves reports became a widespread transparency measure across major exchanges following the 2022 collapse of FTX. Withdrawals remained suspended while security checks were conducted, while a subsequent note clarified that deposits were unaffected.
The figures leave a distinction between funds that have been frozen and funds that have been recovered. Binance’s ability to close the remaining gap will be measured through its reserve disclosures and the reopening of withdrawals.
Musk’s Posts and CZ’s Response
On October 28, CZ warned followers not to click email links or open attachments, including those sent by familiar contacts. The warning was published on X.
After reports of the breach emerged, Musk posted “Everyday is Zeroday” on X. He later responded to CZ’s phishing warning with fire and laughing emojis in another post.
CZ initially said he wished more people had followed the warning and argued that the incident was more complicated than a single click. Compromised devices, he said, often form part of a broader chain of access.
Hours later, CZ addressed Musk directly, writing: “Elon, have a lot of respect for you, but bad time to troll. Please stop.” In a separate post, he said Binance’s SPCX shares, connected to the $500 million Binance committed to Musk’s roughly $44 billion acquisition of Twitter in 2022, were “worth more than a billion.” He asked Musk for “a little support.”
The exchange between the two turned an active security incident into a public dispute involving shareholder relations and corporate finances.
The Estimated Gap and SPCX Shares
When asked why SpaceX was relevant, CZ posted rough calculations. He described the hack as involving approximately $6.x billion, with $3 billion frozen and a $1.x billion SAFU fund. On that basis, he estimated a gap of about $2 billion, alongside “$1.x billion in SPCX alone,” while characterizing the remaining amount as “still painful, but manageable.”
CZ did not announce that Binance would sell the shares. The SPCX valuation was his claim and was not an audited figure in Binance’s incident notice. His calculation was discussed in another X post.
Yi He responded in the same thread, writing: “Reporting to the major shareholder: Our company’s revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares you are bullish on.” Her post indicated that Binance intended to rely on annual revenue rather than sell the shares at that point.
The dispute has drawn attention because the largest reported exchange heist is also testing confidence in Binance’s ability to manage a multibillion-dollar shortfall in public view. For scale, the previous largest reported theft from a crypto exchange was the February 2025 Bybit hack, in which roughly $1.5 billion in Ethereum was drained from the platform. Users are watching for the return of withdrawals, updated reserves and evidence that SAFU and company funds can cover the losses. Other industry participants are also monitoring whether the incident leads to additional freezes or affects the recovery of assets from the hot-wallet drain. Hot wallets are internet-connected wallets that exchanges use to process routine withdrawals.
The technical exploit and the public reaction are separate parts of the incident. Musk’s posts spread more quickly than a forensic report, while Binance’s statements about revenue, reserves and frozen assets do not replace the fuller post-mortem the exchange said it would publish.
The immediate questions remain whether withdrawals will reopen, whether Binance will publish updated reserves and whether frozen coins remain secured. Those disclosures, rather than public exchanges on social media, will establish how the company ultimately addresses the reported loss.
Source: Live Bitcoin News.