Binance co-founder Changpeng Zhao has cautioned that artificial intelligence is set to accelerate cyberattacks on cryptocurrency platforms and traditional banks in the wake of the exchange’s record-breaking $6.34 billion theft.
The October 29 incident, which Binance has detailed in an official initial findings report, ranks among the largest financial heists on record.
Attackers drained hot wallets across multiple blockchains in a carefully planned operation that stretched over months, beginning with social engineering and culminating in the abuse of internal systems.
The FBI has linked the attack to North Korea’s TraderTraitor group.According to Binance’s account, the campaign started in June when a wallet infrastructure engineer downloaded a compromised software package while attempting to install a popular AI coding tool.
Security teams detected the anomaly, replaced the device, and rotated credentials, but the intrusion exposed details about the engineer’s role and colleagues.
In September, a different engineer was targeted through a legitimate job platform by someone posing as a recruiter.
After building trust through video calls and shared social media content, the engineer was directed during a subsequent interview to download a coding “assignment.”
The file contained sophisticated malware that evaded detection, replaced legitimate development tools, and established a backdoor.
On October 20, the attackers leveraged the compromised computer along with an internal AI tool to expand their access, gaining control over additional wallet engineers’ systems and locating a deployment token.
Nine days later, they used stolen credentials to deploy malicious code and initiate unauthorized transfers. In a short window, large amounts of XRP, SOL, OP, BTC, and other assets left Binance hot wallets.
The attackers further exploited Ethereum’s EIP-7702 feature to delegate control over a multi-party computation wallet, allowing them to move funds even after some containment measures.
Binance ultimately cleared the unauthorized authorization the following day.
The exchange has stated that roughly $2.85 billion of the stolen assets have been frozen or intercepted with help from industry partners, including stablecoin issuers.
It has replenished 98 percent of impacted token holdings from company resources and its Secure Asset Fund for Users, with the remaining illiquid assets being acquired.
No user funds will be lost, Binance has emphasized, and withdrawals have been restored in phases after a temporary suspension for security checks.
Zhao, who no longer runs the company, told media outlets that the industry must deploy AI defensively because attackers are adopting the technology more quickly than institutions can secure themselves.
“The industry needs to use AI to prevent AI hacks. There’s no other way,” he said.
He noted that an attacker needs only one vulnerability, while defenders must identify and close every one.
In the near term, Zhao expects more frequent incidents; attacks that once occurred infrequently could become weekly occurrences as AI lowers the barrier to sophisticated operations.
He also argued that if a major crypto exchange can be breached, traditional banks may face even greater exposure given their larger attack surfaces and slower adaptation to AI threats.
Discussions are underway, he indicated, about an industry alliance to share lessons, best practices, and rapid fund-freezing mechanisms.
Blockchain analytics firm Elliptic has reported no evidence that AI agents directed the subsequent laundering of the stolen funds, describing the movement instead as consistent with human-supervised scripts using automated services.
Binance itself has said it will increase investment in AI-powered threat detection and behavioral monitoring, rebuild affected systems, and commission independent reviews.
User confidence appears to be stabilizing.
After more than $7 billion in net outflows in the immediate aftermath of the hack and withdrawal suspension, Binance recorded roughly $2.3 billion in 24-hour net inflows as access was expanded, according to data tracked by DefiLlama and confirmed in company statements.
Hourly deposits began exceeding withdrawals by early November 3.
While longer-term rolling figures still show substantial prior outflows, the turnaround marks an early sign that immediate panic is easing.
The episode underscores both the growing role of AI in complex attacks and the need for coordinated defenses across crypto and traditional finance. Binance has framed the public release of its findings as a contribution to broader industry learning.
