Binance’s CZ warns of hidden security risks in acquiring smaller exchanges

Changpeng Zhao, the founder of Binance and perhaps the most influential figure in crypto exchange history, is reminding the industry of something uncomfortable: buying a smaller exchange isn’t just a business deal. It’s adopting someone else’s security nightmares.

CZ’s core argument is straightforward. When a larger platform acquires a smaller one, it doesn’t just inherit users and order books. It inherits legacy vulnerabilities, outdated code, potentially compromised infrastructure, and security practices that may have been duct-taped together by a skeleton crew.

The security gap between big and small exchanges

Back in February 2020, Zhao emphasized that smaller exchanges are disproportionately targeted by hackers precisely because their security measures tend to be weaker. CZ has noted that larger exchanges maintain significantly better security protections than their smaller counterparts, which makes intuitive sense when you consider the economics involved.

Security isn’t a feature you bolt on after a deal closes. It’s baked into architecture decisions made years earlier, in the database schema, the key management protocols, the way user credentials are stored. When an acquirer takes over a platform with weak foundations, remediating those issues can cost more than building from scratch.

Why this matters in the current M&A climate

CZ’s warning carries extra weight given his own trajectory. He founded Binance in 2017, and it rapidly became the world’s largest exchange by trading volume. He stepped down as CEO in 2023 amid regulatory pressures. His memoir, Freedom of Money, released on April 8, 2026, explores many of the challenges Binance faced during its meteoric rise and the regulatory scrutiny that followed.

What investors and traders should watch

For anyone holding funds on an exchange that recently completed or announced an acquisition, CZ’s comments should prompt some practical questions. Has the acquiring platform disclosed its security audit process for the acquired entity? Are user funds from the smaller platform being migrated to the acquirer’s infrastructure, or are legacy systems still running? Is there a transition timeline?

Recent discussions around CZ have largely centered on his regulatory history and emerging threats like quantum computing risks rather than M&A specifically. Quantum threats are theoretical and years away from practical relevance. Legacy vulnerabilities at poorly secured exchanges are exploitable right now, today, by attackers with off-the-shelf tools.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.