CZ Expects a Bull Market to Draw More Capital In, Urges Retail Investors to Learn Asset Security

Binance founder Changpeng Zhao, known as CZ, expects more capital to enter the crypto market if a bull market returns. His outlook comes with a caution for individual investors: choosing where to hold assets is only one part of managing risk. Knowing how to protect them is just as important.

In a November 3 interview, CZ discussed how users respond to security incidents, the trade-offs between exchanges and self-custody, and the need for stronger security investment across the industry. His comments point to a broader reality: there is no custody arrangement that eliminates risk entirely.

Why Funds Move After a Security Incident

A security incident can prompt users to withdraw assets, even when a platform covers the losses. Institutions may need to follow internal risk policies, while individual users may decide to reduce their exposure or reassess their options.

CZ said Binance had absorbed losses from the incident he discussed and that he had not personally lost funds on the platform. He also said the platform had repaired the issue. Those statements describe his account of the event; they should not be taken as a guarantee that every future loss would be covered.

He added that, in his assessment, less than 10% of the withdrawn funds had gone to other centralized exchanges. That does not establish exactly where the remainder went: funds can move through multiple addresses, and on-chain activity alone may not reveal who controls a wallet or why a transfer occurred.

CZ also pointed to a later shift toward hourly net inflows as a sign of renewed confidence, while acknowledging that flows could continue to fluctuate over the following weeks and months. Short-term flows are useful context, but they are not a complete measure of a platform’s security or financial health.

Exchange Custody and Self-Custody: Different Risks, Different Responsibilities

When assets remain on a centralized exchange, the user relies on the platform’s security systems, operational controls and ability to meet withdrawal requests. Users should also understand the exchange’s terms, including how it handles incidents and whether any protection arrangements have limitations.

Self-custody changes that relationship. The user controls the keys needed to authorize transactions, but also becomes responsible for protecting access. A self-custody wallet is not automatically safe simply because assets have left an exchange.

The choice is not necessarily all-or-nothing. Depending on their needs, users may keep some funds available for trading while holding longer-term assets separately. The right balance depends on factors such as transaction frequency, the amount involved and the user’s ability to manage backups securely.

Hardware Wallets Reduce Exposure, but Do Not Remove Every Risk

A hardware wallet is designed to keep private keys separate from an internet-connected device while allowing the owner to review and authorize transactions. That separation can reduce exposure to some threats affecting a computer or phone.

It cannot, however, make every transaction safe. A user can still approve a malicious contract, send funds to the wrong address or disclose a recovery phrase. Risks can also arise before a wallet reaches its owner: CZ highlighted supply-chain attacks and weaknesses in how recovery phrases are generated as examples of threats users may struggle to detect.

For that reason, device security should be considered alongside purchasing and setup practices:

• Buy through a trusted channel. Follow the manufacturer’s guidance for checking the device and its packaging.
• Generate the recovery phrase during setup. Never use a phrase supplied by a seller or included on a pre-filled card.
• Verify important transaction details on the device. Check the destination address and amount before approving.
• Treat unexpected security alerts cautiously. A message urging you to enter a recovery phrase or move funds immediately may be a phishing attempt.

For more on recognizing fraudulent messages, see the Cybersecurity and Infrastructure Security Agency’s phishing guidance.

A Practical Security Checklist for Crypto Investors

The most damaging self-custody failures do not always involve sophisticated attacks. A lost backup, a damaged recovery record or a mistaken transfer can be enough to make assets inaccessible.

1. Keep recovery phrases offline. Avoid storing them in cloud notes, email, screenshots or messages. Anyone who obtains a phrase may be able to control the associated assets.
2. Protect the backup from loss and damage. Choose a secure location and a durable backup method appropriate to your circumstances. Make sure trusted inheritance arrangements are considered without unnecessarily exposing the phrase.
3. Never enter a recovery phrase into a website. Legitimate support staff should not need it to troubleshoot an account or transaction.
4. Test unfamiliar workflows with a small amount. Before a larger transfer, confirm the network, address and receiving process.
5. Review what you sign. Connecting a wallet or approving a smart-contract transaction can grant permissions beyond a single payment. Read the request carefully and avoid interactions you do not understand.
6. Secure exchange accounts separately. Use a unique password and strong multi-factor authentication where available, and review withdrawal and account-security settings.

Ethereum’s guide to staying safe offers additional background on wallet security, scams and transaction risks.

AI Security Tools Can Help, but Users Still Need Judgment

CZ argued that the crypto industry should invest more in security engineering and make greater use of AI-based tools and specialist providers. Such tools can help teams examine suspicious activity or prioritize alerts, but their usefulness depends on how they are implemented and monitored.

For users, the same caution applies in reverse: AI can make fraudulent messages and impersonation more convincing. A polished support conversation, a familiar-looking voice or an urgent warning is not proof that a request is legitimate. When in doubt, independently navigate to the service’s official support channel rather than following a link in an unsolicited message.

Preparing for the Next Market Cycle

CZ’s expectation of stronger inflows is conditional on a renewed bull market, not a prediction of when one will begin. If activity does increase, users may encounter more opportunities—but also more urgent trading decisions, unfamiliar applications and security risks.

The practical lesson is to build a custody plan before market pressure rises. Understand what an exchange is responsible for, what you must protect yourself, and how you would recover access if a device were lost. For users who choose self-custody, a hardware wallet such as OneKey can be part of that plan, provided it is paired with careful transaction review and a secure recovery-phrase backup.