Binance co-founder Changpeng “CZ” Zhao has warned that acquisitions of smaller crypto exchanges can expose buyers to hidden security risks, saying companies that pursue growth through deals may take on undisclosed technical, operational, and compliance weaknesses that emerge only after a transaction is completed.

The warning, shared through CZ’s account on X, presents exchange acquisitions as a security issue, not only a financial or strategic decision. His argument is that a smaller platform may appear sound in a standard financial review while its wallet architecture, key-management procedures, and older infrastructure remain insufficiently examined. In crypto, that distinction matters because exchanges often combine trading, custody, withdrawals, and user-account controls in the same operating environment, so inherited technical weaknesses can directly affect customer access and asset security.

Why CZ Says Smaller Exchange Deals Can Carry Hidden Risks

In this context, “hidden security risks” refers to weaknesses that may not be visible during a surface-level review of a target company’s finances. These can include undisclosed wallet-security gaps, poor cold-storage discipline, weak internal access controls, and unresolved vulnerabilities in legacy systems.

Such liabilities transfer to the acquirer once a deal closes. Custody exposure, hot-wallet weaknesses, and privileged-access failures do not disappear because ownership changes. They become the responsibility of the buyer and, by extension, may affect the users of the combined platform.

CZ’s caution comes amid corporate changes involving BitMEX and BitMart, both of which have signaled significant shifts in their operations. BitMEX published a notice on its blog regarding closure-related changes at bitmex.com, while BitMart issued an “Important Notice Regarding the Orderly Cessation of BitMart Operations” through its support site at bitmart.zendesk.com. When acquisition-led expansion appears attractive, existing security debt can be obscured by the momentum of a deal.

BitMEX also illustrates how compliance exposure can become a lasting liability. The exchange previously pleaded guilty to a Bank Secrecy Act violation, according to a U.S. Department of Justice announcement at justice.gov. That case shows how regulatory history can remain tied to a platform, its operations, and its infrastructure after business conditions change.

What Buyers Should Review Before Acquiring an Exchange

Security due diligence in an exchange acquisition should extend beyond financial statements. Buyers should review wallet architecture, cold-storage controls, codebase hygiene, internal security practices, and the way the target platform handled any previous breaches or incidents. A company’s breach-response record can indicate how it may perform under pressure after integration.

Operational reviews should also confirm that user funds are properly segregated, privileged access is tightly controlled, and third-party vendor dependencies do not create additional attack surfaces. Weak fund segregation and loose administrative access are among the failures that can turn an acquisition into a long-term liability. Integration planning is also part of the risk picture, since account migration, wallet consolidation, API changes, and staff access changes can create security gaps if they are rushed or poorly documented.

Compliance weaknesses can also function as security risks. Weak know-your-customer, anti-money laundering, or sanctions controls may expose a merged platform to account abuse and enforcement pressure. Similar risk categories have affected overseas venues, including the 29 overseas crypto exchange apps that were pulled from South Korea’s Google Play over registration issues.

The user-safety implications are what make CZ’s warning relevant beyond corporate dealmaking. Exchange customers generally do not see due-diligence materials, but they can face the consequences if inherited vulnerabilities are later exploited. The broader threat environment already includes social-engineering campaigns, such as BlueNoroff’s reported fake Zoom and Teams meeting lures targeting crypto users directly.

For traders deciding where to hold funds, the key issue is that a rebranded or newly acquired exchange depends on the security of the infrastructure underneath it. In any future exchange consolidation, public details on custody arrangements, withdrawal continuity, incident history, and regulatory status will be important signals for users trying to understand what has changed operationally. That concern exists alongside wider regulatory-clarity debates, including warnings from companies such as Coinbase that crypto business activity could move abroad if U.S. legislative progress stalls.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.