What to Know
- Binance founder Changpeng “CZ” Zhao warned that artificial intelligence could fuel more attacks against cryptocurrency exchanges and banks.
- The warning followed the Oct. 29 Binance heist, a $6.4 billion theft attributed by the F.B.I. to North Korea’s TraderTraitor hacking group.
- Zhao offered no evidence that AI was involved in the attack, and investigators found no evidence that AI agents directed the laundering of stolen funds.
- Blockchain analytics firm Elliptic said the movement of stolen funds appeared automated, but not controlled by AI agents making decisions.
- Binance recorded $10.97 billion in withdrawals and $5.28 billion in net outflows over a 46-hour period ending Tuesday, based on figures shared by Binance CEO Richard Teng.
- Zhao said an initial $3.6 billion in outflows represented about 2% of Binance holdings, implying roughly $180 billion in assets.
- Researchers estimated that $2.85 billion in stolen funds had been frozen or seized with assistance from Tether, Circle, law enforcement agencies and the U.S. Secret Service.
- Zhao said the industry needs to use AI to counter AI-enabled threats and called for common security standards or an industry alliance.
AI Security Fears Rise After Binance Theft
Binance founder Changpeng “CZ” Zhao is warning that artificial intelligence could intensify the cyber risks facing cryptocurrency exchanges and banks after Binance suffered a $6.4 billion theft last week. His message is not that AI has been proven to have powered the breach, but that automated tools are lowering the barrier for attackers and may make complex intrusions easier to execute in the near term.
Zhao said the industry needs to use AI to prevent AI hacks, arguing that defensive systems must evolve as quickly as offensive capabilities. His warning reflects a broader concern across digital assets: attackers need only find one weakness, while financial platforms must identify and secure every possible point of entry. That asymmetry has long defined cybersecurity, but AI could make the imbalance more severe if malicious actors use automated systems to scan infrastructure, generate social engineering campaigns or accelerate exploit development.
The immediate backdrop is the Oct. 29 Binance heist, which the F.B.I. attributed to North Korea’s TraderTraitor hacking group. Zhao did not focus on North Korea in his public warning, instead emphasizing the wider challenge facing exchanges and traditional financial institutions as AI tools become more accessible. He said hackers are gaining access to AI capabilities faster than financial firms are deploying them defensively.
No Evidence AI Agents Laundered the Stolen Funds
Despite Zhao’s broader warning, investigators have not found evidence that AI agents directed the laundering of the stolen Binance funds. Blockchain analytics firm Elliptic said the transactions appeared to follow automated scripts rather than decisions made by AI agents. Elliptic co-founder Tom Robinson said the laundering was automated, but that nothing observed showed an AI agent making decisions.
That distinction matters for crypto markets because automation and AI are not the same thing. Automated scripts can move assets through predetermined steps without adapting to changing conditions. AI agents, by contrast, could theoretically evaluate new information, adjust routing choices, select bridges or mixers, and respond dynamically to freezing attempts. In this case, the available findings concern the movement of the stolen funds and do not establish that AI was used to direct laundering activity.
The same caution applies to the initial breach. Zhao did not provide evidence that AI played a role in how hackers gained access to Binance systems. The central issue raised by his warning is forward-looking: as AI systems improve and become easier to use, attackers may gain more powerful tools for reconnaissance, phishing, code generation and operational coordination. That could raise the pressure on crypto venues to adopt equally advanced defensive systems.
Withdrawals Surge as Binance Works to Stabilize Flows
The theft triggered a sharp wave of withdrawals from Binance as customers reacted to the security incident. Zhao said an initial $3.6 billion in outflows represented about 2% of Binance holdings, implying roughly $180 billion in assets. He said he had expected withdrawals of between 10% and 30%, equivalent to $18 billion to $54 billion based on that estimate.
Figures shared by Binance CEO Richard Teng showed $10.97 billion in withdrawals and $5.28 billion in net outflows over a separate 46-hour period ending Tuesday. Teng said hourly deposits had begun exceeding withdrawals, although Binance remained in net outflow over the full period. For exchange operators, those flow dynamics are closely watched because they can influence customer confidence, liquidity conditions and the perceived resilience of a platform under stress.
Net outflows do not necessarily signal insolvency or failure, but they can show how quickly trust can be tested after a major exploit. In crypto, customers can often move assets around the clock, which means sentiment shifts may translate into immediate blockchain activity. That speed is one of the sector’s defining features and one of the reasons exchange security remains a central concern for institutional and retail participants alike.
Frozen Funds Offer Partial Relief
Zhao said Tether, Circle and law enforcement agencies helped freeze stolen funds, with the U.S. Secret Service assisting in the effort. Researchers estimated that $2.85 billion had been frozen or seized. That figure represents a substantial portion of the stolen amount, though it does not erase the damage caused by the breach or the broader questions it raises about exchange defenses.
Freezing stolen assets often depends on the type of token involved, the infrastructure used to move funds and the responsiveness of issuers, exchanges and law enforcement. Stablecoin issuers can sometimes freeze assets when tokens remain within systems they can control, while other crypto assets may be harder to intercept once moved through decentralized infrastructure. The Binance case shows that rapid coordination can limit attacker options, but it also highlights the need for faster detection and response.
For the wider market, the recovery effort is likely to be viewed alongside the scale of the theft. A multibillion-dollar exploit can affect confidence even when a large amount is frozen or seized. Market participants tend to focus not only on the immediate loss, but on whether the same methods could be used again against another exchange, custodian or bank.
Zhao Calls for AI Defenses and Shared Standards
Zhao said the risks extend beyond cryptocurrency. He argued that if a crypto exchange can be hacked, banks may also be exposed as AI improves attackers’ capabilities. Banks typically operate with older infrastructure, complex vendor relationships and deeply interconnected payment systems. Crypto exchanges, meanwhile, combine internet-facing platforms with digital asset custody, making both sectors attractive targets for sophisticated attackers.
His proposed response centers on AI-based defenses and common security standards. Zhao called for an industry alliance or shared framework that could help firms respond to attacks more effectively. He said discussions were underway, although no details had been agreed on yet. Such an effort could include incident reporting practices, coordinated blacklisting, stronger wallet controls, threat intelligence sharing and standardized emergency response procedures.
Common standards are difficult to implement across a competitive global industry, but major hacks often accelerate coordination. Exchanges, stablecoin issuers, analytics firms and law enforcement agencies already cooperate during large incidents, especially when stolen funds move across widely monitored blockchains. A more formal framework could reduce response times and make it harder for attackers to exploit gaps between platforms.
Short-Term Risk Remains Elevated
Zhao said he expects more attacks in the short term, even as he believes AI could eventually strengthen financial security. That dual outlook captures the tension now facing the crypto industry. AI can help defenders detect anomalies, identify suspicious transaction patterns, prioritize vulnerabilities and monitor infrastructure at scale. The same technology can also help attackers probe for weaknesses, craft more convincing deception campaigns and automate parts of an intrusion.
Technical traders and market participants are likely to watch whether major exchanges increase transparency around reserves, security investments and incident response planning after the Binance theft. Security events can influence exchange market share, stablecoin flows and broader risk appetite, especially when the size of a breach is large enough to dominate industry attention.
For now, the key factual line remains clear: Binance suffered a $6.4 billion theft attributed by the F.B.I. to North Korea’s TraderTraitor hacking group, while investigators have not found evidence that AI agents directed the laundering of stolen funds. Zhao’s warning is about what may come next. In his view, the industry cannot rely on traditional defenses if attackers are moving toward faster, more automated methods. The next phase of exchange security may depend on whether defensive AI can be deployed before offensive AI becomes a routine tool for hackers.
Frequently Asked Questions (FAQs)
What did CZ warn about after the Binance theft?
Changpeng “CZ” Zhao warned that artificial intelligence could fuel more cyberattacks against cryptocurrency exchanges and banks. He said the industry needs to use AI defensively to counter AI-enabled threats.
Was AI proven to be involved in the Binance hack?
No. Zhao did not provide evidence that AI played a role in the attack, and investigators have not found evidence that AI agents directed the laundering of stolen funds.
Who attributed the Binance theft to North Korean hackers?
The F.B.I. attributed the $6.4 billion Binance theft to North Korea’s TraderTraitor hacking group. Zhao’s comments focused on wider AI-related security risks rather than on North Korea specifically.
How much was stolen from Binance?
The Binance theft totaled $6.4 billion. The incident has intensified scrutiny of exchange security and the ability of financial platforms to defend against advanced cyber threats.
How much money flowed out of Binance after the incident?
Figures shared by Binance CEO Richard Teng showed $10.97 billion in withdrawals and $5.28 billion in net outflows over a 46-hour period ending Tuesday.
How much of the stolen money has been frozen or seized?
Researchers estimated that $2.85 billion in stolen funds had been frozen or seized. Zhao said Tether, Circle, law enforcement agencies and the U.S. Secret Service assisted in the effort.
Why is AI considered a cybersecurity risk for crypto exchanges?
AI may help attackers automate reconnaissance, improve phishing attempts, scan for vulnerabilities and accelerate complex operations. Defenders must secure every weakness, while attackers need only find one opening.
What security response did Zhao suggest?
Zhao called for AI-based defenses, common security standards and a possible industry alliance to help firms respond more effectively to attacks. He said discussions were underway, though no details had been finalized.
Could AI eventually improve crypto security?
Yes. Zhao said AI could eventually strengthen financial security by improving detection and defense, even though he expects more hacks in the short term as attackers gain access to more advanced tools.
