At 4:05 p.m. Eastern on Thursday, October 29, 2026, money began leaving Binance wallets on ten blockchains. About 20 minutes later, most of it was gone. By Friday, a guest on Fox Business was predicting a “bloodbath of AI hacking” still to come.
That warning is a forecast, not a finding. As of October 31, 2026, no public evidence shows AI was used to break into Binance. What is documented is a record theft of roughly $6.3 billion and a likely North Korean operation, according to two blockchain analytics firms. Separately, Microsoft reports that North Korean groups use AI heavily in other parts of their playbook. This article separates the verified facts from the speculation, then covers what to do about your own crypto.
What did the expert actually say about an “AI hacking bloodbath”?
Eric Schiffer, chairman of Patriarch and Reputation Management Consultants, told Fox Business that the theft could be an early sign of a wider wave of attacks as AI grows more powerful. His words were “the bloodbath of AI hacking is to come.”
He also said companies can no longer treat security as something to fix after an attack. He predicted Binance would recover financially but take a credibility hit, and that some customers would leave. For individual investors, he suggested asking whether you trust the platform holding your coins, and considering alternatives to holding crypto directly on an exchange, such as exchange-traded funds.
What most people miss: Fox’s own text describes Schiffer as a financial and reputation-management expert. He presented no evidence that AI was involved in this attack. His comments are an opinion about where the trend is heading.
Was AI used in the Binance hack?
No public evidence says so. Analysts quoted by The National and Khaleej Times both said they saw no sign AI was used, while arguing AI could make attacks like this cheaper and faster. Binance’s own account describes entry points but not the tools used. It first pointed to a compromised DevOps engineer’s laptop. On Friday it said later findings revealed additional points of breach.
The closest thing to an “AI clue” is a post-theft observation. On October 30, Chainalysis said it was seeing laundering patterns it had never seen before. Thousands of transactions in a short period, with funds looping back through earlier addresses, suggested automation. Automation means scripts and programmed processes. It does not mean an AI system made decisions, and Chainalysis did not say that.
| Claim you may have seen | What the sources support | Status as of Oct 31, 2026 |
|---|---|---|
| “AI hacked Binance” | No source says AI was used to break in | Unsupported |
| “AI automated the laundering” | Chainalysis says transaction patterns suggest automation | Automation suggested, AI not shown |
| “North Korean groups use AI” | Microsoft Threat Intelligence rated their overall AI adoption “high” on October 29 | Documented, but not tied to Binance |
| “More AI attacks are coming” | Expert forecasts only | Opinion |
What happened to Binance, step by step?
TRM Labs, a blockchain intelligence firm, published a detailed on-chain reconstruction on October 29. The times below are UTC and come from TRM unless noted. Treat them as one analyst’s account, not a final investigation.
| When | What happened |
|---|---|
| Oct 28, morning | The attacker’s operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from. TRM says preparation began at least 36 hours before the theft. |
| Oct 29, earlier | The attacker tested code on two wallets, rehearsed the final version on a third, then installed the same code on a Binance hot wallet about four hours later. |
| 20:05–20:09 | Five Binance wallets on the XRP Ledger sent 233.46 million XRP to one attacker address. |
| 20:20 | A Binance Bitcoin hot wallet sent 18,270 BTC out. On Ethereum, one transaction carried 50 pre-signed authorizations. Under 3.5 minutes later, the hot wallet was told to send its entire balance. |
| 21:01–21:04 | Tether froze 971.1 million USDT. Circle froze about 823 million USDC. |
| 23:05 | A second wave hit Binance wallets on Avalanche and Polygon. |
| 23:35 | Binance said verified frozen assets had reached $2.54 billion. |
| Fri, Oct 30 | Binance said its investigation found additional breach points beyond the laptop. |
A hot wallet is an internet-connected wallet an exchange uses to process customer withdrawals. TRM’s assessment is that the attacker gained the ability to make Binance’s signing system approve transactions of the attacker’s choosing across many chains. Wallets on ten blockchains, using different key types, all produced valid signatures within about half an hour. TRM also notes that Binance has not yet published a root cause.
Binance says it found no evidence that wallet private keys leaked. Mark Karpeles, the former head of the collapsed Mt. Gox exchange, told Reuters he believes the attackers probably accessed keys for at least two Binance wallets. That is an outsider’s view, not a finding. The question is open until Binance publishes the technical post-mortem it has promised.
How much was stolen, and why do the numbers differ?
The headline figure is about $6.3 billion, but three sources use three slightly different measures.
| Source | Figure | What it measures |
|---|---|---|
| Binance | About $6.3 billion | Its estimate of total impact; it warned the number may rise |
| TRM Labs | About $6.36 billion | Value of transfers at the price when each was taken (about $6.23 billion at TRM’s later prices) |
| Chainalysis | About $6.4 billion | Its own tally of the theft |
On freezing, Binance says about $3 billion is frozen on-chain. TRM counts about $2.7 billion frozen as of 00:30 UTC on October 30. Of that, roughly $2.67 billion is stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial. TRM says the attacker still controls about $2.4 billion in assets that no issuer can freeze, including more than 420,000 ETH and 18,270 BTC.
For scale, our calculation of TRM’s figure against the February 2025 Bybit theft ($1.5 billion) gives about 4.2 times larger. TRM’s 2026 Crypto Crime Report counted $2.87 billion stolen across nearly 150 attacks in all of 2025, so this one theft is more than twice that total.
Who is behind the Binance hack?
Two blockchain analytics firms say North Korea. Binance and U.S. authorities have not confirmed it. TRM attributes the theft to TraderTraitor, a North Korean state-backed unit linked to the Lazarus Group, and says it makes that judgment with high confidence. Chainalysis reached the same conclusion. It pointed to stolen Binance funds mixing in real time with proceeds from last month’s Bitget exploit, which had been attributed to North Korean actors.
Binance co-CEO Richard Teng said the investigation has not attributed responsibility to any individual. President Donald Trump said on Friday that his administration was looking into whether North Korean hackers were responsible. The U.S. Secret Service said it is working with private-sector partners, including Circle, and coordinating with the U.S. Attorney’s Office for the District of Columbia. North Korea routinely denies involvement in crypto theft.
Private-sector attribution is evidence, not a legal finding. For context, the FBI named the same unit as responsible for the Bybit theft in 2025.
What does Microsoft’s North Korea AI report say?
Microsoft says North Korean groups use AI widely, but humans still direct the operations. On October 29, the same day as the theft, Microsoft Threat Intelligence published a report ranking eight North Korean groups on four stages of AI adoption. Three groups sit at the top “operationalized” stage: Jade Sleet, Coral Sleet and Jasper Sleet. Microsoft rates the overall adoption as high. The report I read does not mention Binance.
What Microsoft actually documented is narrower than the “bloodbath” framing:
- Recruiter lures. Between June 8 and June 12, 2026, Jade Sleet posed as recruiters for a spoofed AI-powered blockchain intelligence company. It targeted people in cybersecurity, AI, blockchain and recruiting, and used two more front companies within the same week.
- Volume. Onyx Sleet produced over 100 tailored PDF lures in August and September, apparently in minutes.
- Code help. AI-assisted development tools such as Cursor likely helped several groups write, debug and disguise malware.
- Agentic testing tools. Since late October 2026, Onyx Sleet and Pearl Sleet have used an open-source agentic penetration-testing framework called ARTEX.
Microsoft’s own conclusion is that these operations remain human-directed and have not become fully autonomous. It says AI mostly speeds up work the groups already did, such as research, lures and fake identities.
What most people miss: AI’s documented role sits upstream, in finding targets and tricking people. Binance’s first explanation also started with one engineer’s laptop. That is a pattern worth watching, but no one on record has connected the two.
Is the “bloodbath” forecast fair?
It is plausible as a trend and unproven for Binance. The case for concern is real. Microsoft rates North Korean AI adoption as high, groups are adopting agentic tools within weeks of release, and Chainalysis sees automation in the laundering. The same Microsoft report names cryptocurrency and financial firms among the most common North Korean targets.
The case for caution is also real. Microsoft says operations are not autonomous. The International AI Safety Report 2026 likewise finds that humans remain in the loop for cyberattacks, even with AI assistance. Analysts describing the Binance breach point to human and operational failures rather than a flaw in blockchain technology.
My read: “bloodbath” is a rhetorical forecast with no measurable test. Two things would change the picture: Binance’s post-mortem naming AI tooling, or law enforcement describing AI use in the intrusion. Until then, the defensible statement is that AI is lowering the cost of the steps before a theft. Wider industry worries about AI’s offensive capability are also fueling the policy debate we covered in why AI leaders want to pace the frontier. Our AI Policy & Ethics coverage tracks how that debate develops.
Is your crypto safe on Binance right now?
Binance says yes and has promised to absorb the loss, but the claim is not yet independently verified. The company says user funds are safe and that it will cover the theft with company money, not users’ money. In its second update, issued Friday, October 30, it said it had set aside more than $6.34 billion. About $5 billion of that is already held in the same kinds of tokens that were stolen, and the company said it is buying the rest on the market and over the counter.
Its Secure Asset Fund for Users (SAFU) is a roughly $1 billion emergency reserve created in 2018. That is about one-sixth of this loss, so the company’s own balance sheet is the real backstop.
Binance’s timetable, as of October 31, 2026:
- Withdrawals: a phased restart targeted within about 34 hours of the Friday update, around November 1, subject to security checks. It is a target, not a guarantee.
- Deposits: Binance says they are running normally.
- Proof of reserves: a first snapshot was planned within 12 hours of the update, with results due by Monday, November 2.
- Post-mortem: Binance says it will publish a detailed technical report once facts are verified.
If you are in the U.S., note that Binance.US said it is a separate, independent platform and that its customer funds and services are operating normally.
Do not assume the usual safety nets apply. FDIC deposit insurance covers eligible bank deposits, not crypto held at exchanges. SIPC says it does not protect any digital asset that does not qualify as a “security.” Al Jazeera, citing experts, reports that most crime and cyber-insurance policies do not cover stolen cryptocurrency.
A five-question exchange check
This is an original checklist built from the facts above. It is illustrative, not an industry standard.
| Question | Why it matters | What to look for |
|---|---|---|
| 1. How much needs to sit on an exchange? | Crypto markets expert Sean Foley of Macquarie University says exchange-held assets are only as safe as the exchange, and bigger holdings make bigger targets | Keep trading balances there; decide on purpose where long-term holdings live |
| 2. Does the platform publish proof of reserves and a post-mortem? | Promises are cheap; published evidence is not | Binance’s November 2 reserve results and its technical report |
| 3. What exactly is the backstop? | A fund or balance sheet is not federal insurance | Whether the platform names its reserve, its size and what it covers |
| 4. Is my own account locked down? | Exchange breaches are not the only risk | Strong two-step login and withdrawal protections your platform offers |
| 5. Can I spot recovery scams? | Large incidents tend to attract impersonators | Treat any message offering compensation or withdrawal help as suspect until confirmed inside the official app |
Myth vs fact
| Myth | Fact |
|---|---|
| AI broke into Binance | No public evidence shows that; the entry method is still under investigation |
| Binance customers lost their money | Binance says users are covered and funds are safe; reserve results are due November 2 |
| The blockchain itself was hacked | Analysts describe operational and human failures at the exchange, not a flaw in the underlying technology |
| North Korea is confirmed | Two analytics firms attribute it with high confidence; Binance has not attributed it and authorities are still investigating |
| Private keys were definitely stolen | Binance says it has no evidence of leaked keys; one outside expert disagrees |
What to watch next
As of October 31, 2026, these are the dated milestones:
- About November 1: Binance’s targeted start of phased withdrawals.
- By November 2: results of Binance’s first proof-of-reserves snapshot.
- In the coming days: Binance’s technical post-mortem and further freezes. TRM expects the attacker to move funds through bridges, swap services and over-the-counter brokers.
- Any law enforcement statement on attribution or on AI use in the intrusion.
For ongoing updates, follow AI News on AI LLM News.
FAQs
Did AI hack Binance?
No public evidence shows it did. Analysts and reporters note that Binance and the blockchain firms have described the breach without naming AI tools. The “AI hacking bloodbath” line is a prediction about future attacks.
How much was stolen from Binance?
Binance estimates about $6.3 billion. TRM Labs counts about $6.36 billion and Chainalysis about $6.4 billion. The differences come from how and when the stolen assets are valued.
Who is Eric Schiffer?
He is chairman of Patriarch and Reputation Management Consultants. Fox Business describes him as a financial and reputation-management expert, and he spoke to the outlet on October 30.
Who carried out the Binance hack?
TRM Labs and Chainalysis attribute it to North Korea’s TraderTraitor unit. Binance has not attributed it, and U.S. authorities say they are still investigating.
Will I lose my crypto on Binance?
Binance says it will cover all losses and has set aside more than $6.34 billion. Its proof-of-reserves results, due by November 2, are the first independent-style check you can read.
When will Binance withdrawals resume?
Binance targeted a phased restart about 34 hours after its Friday update, around November 1. That is a goal subject to security checks.
Is crypto on an exchange insured in the U.S.?
Generally no. FDIC insurance covers bank deposits, and SIPC says it does not protect digital assets that are not securities. Some exchanges carry private coverage, but its scope varies by company.
Conclusion
The verified story is a record theft, a likely North Korean operation and an exchange that says it can absorb the loss. The “AI bloodbath” is an expert’s forecast, and no public evidence ties AI to this break-in.
Key takeaways:
- Judge the forecast by the evidence: AI is documented in lures, tooling and automation, not yet in the Binance intrusion.
- Exchange-held crypto has no FDIC or SIPC safety net; the platform’s own balance sheet is the backstop.
- The next facts that matter are the proof-of-reserves results and the post-mortem.
Your next step: write down how much of your crypto sits on exchanges, and decide whether that number matches your risk tolerance before the post-mortem lands.
Related: AI Coding Agents vs Chatbots: Which One Should You Trust With Your Codebase in 2026?
Disclaimer: This article is for informational purposes only and is not financial, investment, legal or security advice. It is not affiliated with, sponsored by or endorsed by Binance, TRM Labs, Chainalysis, Microsoft, Fox Business or any person or company mentioned. Figures, timelines and policies in a fast-moving incident may change; information last verified on October 31, 2026. Crypto assets carry risk, including total loss, so consult a qualified professional before making decisions.