The AI tools that let one developer do the work of a whole team are now doing the same for thieves. Binance’s $6.3 billion loss is the loudest warning yet.
The numbers at a glance
• $6.3bn taken from Binance in about 20 minutes, the largest crypto theft on record
• 4x the previous record, Bybit’s $1.5bn in February 2025
• 680 Revolut customers whose passports and financial records were handed to impostors
• 1 in 4 malicious breaches in 2026 involved AI, according to IBM
• 1.6 days is now the average time to exploit a known flaw, down from 30
Twenty minutes, $6.3 billion
On Thursday, around $6.3 billion in digital assets left Binance’s wallets across ten blockchains. It took roughly twenty minutes.
Blockchain analysts at TRM Labs and Chainalysis both pointed to TraderTraitor, the North Korean unit the FBI blames for the $1.5 billion Bybit heist of February 2025. That was the record. It has now been beaten fourfold.
The way in was not some exotic cryptographic flaw. It was one engineer’s laptop. That gave the attacker access to a service container and the power to submit withdrawals that looked legitimate.
Binance says no private keys leaked. About $3 billion has been frozen, mostly stablecoins that Tether and Circle could lock. The exchange has promised to cover every loss and paused withdrawals while it rebuilt its defences.
Revolut: no hack needed
Six weeks earlier, Revolut disclosed a breach of a very different kind. Nobody broke into its systems at all.
Someone sent data requests from a genuine government email domain, later traced by Italian authorities to the prefecture of Reggio Calabria. Staff complied. Passports, transaction histories and bitcoin records for about 680 customers were handed over, many of them apparently wealthy crypto holders. Customers in Malta were among those affected. A reported $3 million ransom demand followed, which Revolut denies engaging with.
One attack was technical, the other entirely human. Neither company has said AI played a part. But together they show how much of our daily financial lives rests on platforms that a single laptop or a single trusting employee can undo and how much more exposed those platforms become once attackers have machines doing the legwork.
Four decades, one race
Hacking has always been a game of leverage: one person, one clever script, damage far out of proportion to the effort.
• 1988: the Morris worm cripples a sizeable share of the early internet, largely by accident.
• 2000s: the ILOVEYOU worm reaches tens of millions of machines in days. Card theft becomes an industry and retailers such as TJX and Target learn the cost of one weak supplier.
• 2014: Mt. Gox collapses, and crypto exchanges become the new bank vaults, with thinner walls.
• 2010s: the states arrive. Stuxnet breaks physical machinery. WannaCry, attributed to North Korea, freezes hospitals across the NHS. SolarWinds gets into thousands of organisations through software they trusted.
• 2019: closer to home, Bank of Valletta shuts its systems after attackers try to move around €13 million abroad.
Through all of it, one constraint held. Serious attacks needed serious people. Finding an unknown flaw, writing a reliable exploit and running a campaign across hundreds of targets took scarce, skilled labour. That scarcity was the defenders’ best friend. It is now disappearing.
One operator, a thousand hands
Anyone who builds software has felt the shift. A competent developer can now hand a project to a team of AI agents: one writes the front end, another wires up the database, a third tests the lot. A fortnight’s agency work is done in an afternoon.
The developer hasn’t become a better coder overnight. They’ve become a manager of fast, cheap, tireless staff.
Criminals have made exactly the same discovery. An attacker with an army of agents doesn’t just work faster. They work in parallel, around the clock, against every target at once.
Exhibit A: Storm-0940
Last week Microsoft attributed a supply-chain attack on ConnectWise Cloud Backup to Storm-0940, a China-aligned group. It used ARTEX, an agentic hacking framework that plugs into almost any AI model, to automate reconnaissance, password spraying and the abuse of app permissions.
• It tried to sign in to more than 2,250 Microsoft 365 tenants
• At peak, roughly 2,900 attempts a minute
• In several cases, privileged cloud access in under three hours
Researchers found prompts telling the models to split up tasks and check each other’s work. That’s exactly how a legitimate engineering team runs its agents today.
The scam factory
The same multiplier works further down the food chain. Phishing emails used to give themselves away with clumsy grammar; now they arrive fluent, personal and in your own language. A chief executive’s voice can be cloned from a minute of conference footage. Romance and investment scams that once needed a call centre can be run by bots that never tire.
IBM’s 2026 Cost of a Data Breach study found one in four malicious breaches this year involved AI, up 56% in a year. Those incidents cost about $6 million each, roughly a million more than the rest.
Where Revolut fits
There’s no evidence AI was used against Revolut and it may well have been old-fashioned social engineering. It’s still a warning. A convincing request on official letterhead used to need patient groundwork. AI could make that groundwork cheap and repeatable against every bank in Europe until one says yes.
That a single email could prise passports and bitcoin records out of one of Europe’s largest digital banks says a great deal about how precarious the platforms we rely on every day really are.
Why defenders are always a step behind
The core problem is an old asymmetry made brutal. A defender must close every door. An attacker needs only one left ajar. For decades that was tolerable, because finding the open door was slow, expensive work. Not any more.
Machines that find the doors
In April, Anthropic said its Claude Mythos Preview model had autonomously found thousands of unknown vulnerabilities in major operating systems and browsers and could write working exploits for them. It judged the capability dangerous enough to restrict access to a small group of infrastructure providers. Other labs are close behind.
Black October
This month showed what that looks like in the wild:
• Researchers at Wiz and Calif, using OpenAI and Google models, found two critical flaws in PHP, the language behind roughly 70% of websites. Dubbed PHP2Shell, they had gone unnoticed for over a decade and let an outsider take over a web server.
• Emergency patches landed on 21st October. Governments took sites offline to apply them.
• The same week, breaches at Railway, LiteLLM and OpenCode put customers’ API keys at risk.
• Chris Krebs, former head of America’s cyber agency CISA, said about 3% of all critical vulnerabilities ever found were discovered in a single month.
Three reasons patching can’t keep up
1. The window has collapsed. A security fix reveals where the hole was. AI can compare old and new code and build an exploit within hours. Tenable’s CFO says average time to exploit has fallen from 30 days to 1.6 in a year. Most large firms still take weeks to roll out a critical patch.
2. The attack surface keeps growing. Every company adopting AI agents hands them credentials, API keys and the authority to act. Each agent is a new identity to steal or trick, as LiteLLM and Railway showed. Prompt injection, where hidden instructions hijack an agent, still has no complete fix.
3. Humans don’t patch. Binance began with one laptop. Bybit began with one developer’s machine at a wallet supplier. Revolut began with one employee trusting one email. AI makes the lure more convincing and sends it to everyone at once.
What comes next
The bad news
The most capable offensive models are held back by the companies that built them. That won’t last. Wiz estimates comparable capabilities will reach open-source models, which anyone can run privately and without guardrails, within 12 to 18 months. At that point, autonomous zero-day discovery stops being the preserve of spy agencies and becomes available to any gang with a decent graphics card.
Rob Joyce, who once ran the NSA’s cyber division, put it bluntly this month: the flood of vulnerabilities is turning into a flood of breaches. Expect:
• Bigger thefts from exchanges and fintechs, where money moves instantly and irreversibly
• More supply-chain attacks, because one compromised vendor opens thousands of customers
• Deepfake fraud aimed at finance teams
• Synthetic identities built from leaked passports and selfies, like those in the Revolut breach
The good news
The PHP flaws were found by defenders first. Black October, for all the noise, produced millions of attack attempts but relatively few successful breaches.
The same models that find bugs can fix them. Google’s CodeMender already uses AI to repair security flaws automatically and Anthropic’s Glasswing programme gives critical software maintainers early access to tools that would otherwise be used against them. If these become standard in every development pipeline, the code shipped in 2028 could be the most secure ever written.
The honest forecast
Somewhere in between. The next two years will be rough, with a backlog of old, fragile software exposed to machines that never sleep. After that, the advantage may tilt back to those who own the systems, as long as they use the same tools as the people attacking them.
Fighting machines with machines
There’s no single fix, but the direction is clear. Six moves that matter:
1. Assume the breach. If your security depends on patching faster than an AI can write an exploit, it will fail. Design systems so a compromised laptop or container can’t reach the crown jewels. Binance’s attacker got from one engineer’s machine to the withdrawal pipeline. That path shouldn’t exist.
2. Put AI on defence, at the same speed. Human analysts can’t triage alerts arriving at machine pace. Companies need their own agents scanning code before it ships, watching for odd behaviour and isolating threats in seconds. Defenders’ edge is context: they know their own systems and they should feed that knowledge to their tools.
3. Treat every AI agent as an employee with keys. Least access necessary, short-lived credentials, every action logged and a human sign-off for anything irreversible, such as moving large sums.
4. Slow money down where it matters. A short delay and a second check on very large or unusual transfers would have limited both Bybit and Binance. Speed is a selling point until it becomes the attacker’s best weapon.
5. Verify the request, not the sender. Revolut’s lesson is that a legitimate email address proves nothing. Confirm requests for sensitive data through a separate, known channel. The same goes for any “CEO” call demanding an urgent payment.
6. Regulate for resilience. Europe’s DORA rules and the NIS2 directive already push financial firms and critical operators this way. Regulators, Malta’s included, should insist on regular AI-assisted testing and fast, honest disclosure when things go wrong.
The bottom line
The cleverest hackers of the past were limited by the hours in a day. That limit has gone.
The industry will spend the next few years catching up and some institutions will learn the lesson the expensive way. The ones that come through will be those that stop treating AI as a productivity tool and start treating it as their front line.
