ai-security
It wasn't an AI that cracked Binance. It was a laptop.
The largest crypto theft on record arrived with an AI story attached. The actual story is older, less exciting and considerably more useful, especially for anyone about to give an AI agent access to a payment system.
When I first heard about it, the story already came with an AI attached: someone had used artificial intelligence to rob Binance of several billion dollars. It sounded plausible, which in 2026 is most of what a story needs to travel, and I passed it on in my head before I had checked a single detail. As far as anyone knows today, it is not what happened.
What happened
On 29 October, roughly 6.36 billion dollars left Binance wallets on ten blockchains, most of it within about twenty minutes. The previous record, the Bybit theft of February 2025, was 1.5 billion. Binance's preliminary finding is almost disappointingly ordinary: attackers compromised the laptop of a DevOps engineer and used it to reach an internal service that was allowed to request withdrawal signatures. On Ethereum, they then used EIP-7702, a feature added to the protocol in 2025, to get approval over a hot wallet in a way that skipped Binance's normal approval controls.
Blockchain analysts at TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean unit that was also behind Bybit. Binance has not confirmed this, has paused withdrawals, has set aside 6.34 billion dollars to cover customer losses, and says it has found additional points of breach since. All of this is the state of things on 31 October, and some of it will move.
Where the AI story comes from
The only machine-shaped detail so far is on the other end: Chainalysis observes thousands of laundering transactions in a short time, which points to automation. Automation is not the same as AI, and a script that splits money across many addresses has existed for as long as there has been money worth splitting.
The irony lies elsewhere. On 23 October, six days before the theft, Binance announced that its AI-assisted security systems had prevented around 4.6 billion dollars in losses in the first half of the year. I have no reason to doubt the number. Those systems watch for customers being tricked, for phishing, for scam transfers. The front door had a hundred models watching it. The attackers came in through the staff entrance.
Could this happen to a bank?
The break-in, yes. In 2016 the Lazarus group, the same family as TraderTraitor, used the SWIFT network to steal 81 million dollars from the central bank of Bangladesh. The difference is not so much in getting in as in what happens afterwards. A bank transfer passes through clearing, limits and correspondent banks, and along the way it can often be stopped or recalled. In Bangladesh, most of the nearly one billion that the attackers tried to move never arrived, partly because someone noticed a typo in a recipient's name.
A blockchain transaction is final within seconds. That several billion of the Binance loot has been frozen is thanks mostly to stablecoin issuers such as Tether, which can block their own tokens. In other words, central parties saved the day, which is a slightly awkward result for an industry that set out to make central parties unnecessary.
Compensation is not a security concept
Binance can pay because Binance is very large. That is reassuring for its customers this week, and it is also the whole problem: the protection came from the size of the company's balance sheet, not from the design of its systems. A smaller exchange with the same laptop and the same twenty minutes would not be issuing statements about compensation. It would simply be gone. And even at Binance, "your money is safe" currently means "your money is safe, you just cannot take it out", which is a sentence that also describes a locked safe whose key has been mislaid.
Where you buy your safe
The obvious answer to all this would be to keep your coins off exchanges, on a hardware wallet in your own drawer. That is sensible, as long as you remember to ask where the drawer came from. Since early October, money has been disappearing from Ledger wallets, roughly 93 million dollars so far. The devices had been sold by a reseller in Malaysia, and someone had opened them, fitted a small module behind the screen that read along as the recovery phrase was set up, and sent it out over the mobile network via an eSIM. Some of these devices were sold at Singapore's Changi Airport, at a premium electronics counter, which is roughly the last place you would expect to be robbed with a receipt. The security chip itself was never touched, so Ledger's own authenticity check waved the devices through. The strongest part held. The packaging did not.
The same question, incidentally, applies to every plugin, every connector and every AI agent you install: not only what it can do, but where it came from.
What actually helps
None of it is new, and none of it needs AI.
- Speed limits on outflows. No system should be able to move billions in twenty minutes without a human having to say yes somewhere in between.
- Little money in hot wallets. Whatever can sign online can be made to sign online.
- Approvals that cannot be bypassed. Including by new protocol features. EIP-7702 was a reasonable feature; every new feature is also a new door, and somebody has to check whether the old locks still fit it.
- Minimal rights for developer machines. A single laptop should not be two steps away from a service that can request withdrawals.
The next DevOps laptop is called an AI agent
This is where it stops being a crypto story. Many companies, small ones included, are currently giving AI agents access to email, invoices, CRM systems and, here and there, e-banking. An agent with payment rights is, functionally, that laptop: something with permissions that another party can talk into doing something, nowadays not through malware but through a well-placed sentence in an email or a PDF.
So the useful questions are the old ones. What can the agent do, as opposed to what it is supposed to do? Is there a daily limit? Does a human confirm anything that cannot be undone? And who would notice within twenty minutes?
The rules that would have helped Binance are older than Binance, which I find both slightly depressing and slightly reassuring. You just have to apply them to the new colleague as well, the one who never sleeps and believes everything it reads.