🔍 Read the full analysis: Binance Lost Billions In About 20 Minutes: An AI Security Lesson on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
TRM Labs says most of about $6.36 billion in crypto linked to Binance was taken across ten blockchains in roughly 20 minutes on Oct. 29. The case highlights a gap between automated attacks and human response, while Anthropic research on multi-agent behavior raises questions about using AI defenders without reliable controls.
Most of about $6.36 billion in crypto was taken from Binance-linked wallets in roughly 20 minutes on Oct. 29, according to blockchain analytics firm TRM Labs. The theft and the time before Binance’s first public statement have renewed debate about whether AI systems could help security teams respond at machine speed—and whether such systems can be kept under control.
TRM Labs said the outflows began at 20:05 UTC and crossed ten blockchains. It said preparations had begun at least 36 hours earlier, including test runs involving smaller wallets. Binance’s first public post saying it was investigating appeared at 21:29 UTC. That public timestamp does not establish when the company first detected the incident internally.
TRM said Tether froze 971.1 million USDT in a main receiving wallet at 21:01 UTC. Elliptic told WIRED that about $2.8 billion, or 44%, had been frozen, mostly in stablecoins. The source material says assets including bitcoin, ether and XRP could not be frozen in the same way. Binance estimated the impact at about $6.3 billion and said users would not bear the loss.
Binance later said its investigation found additional points of breach beyond a compromised laptop it had described earlier. The source material reports that Binance said it had replenished 90% of the stolen assets by Oct. 31 and began reopening withdrawals in phases on Nov. 1, starting with bitcoin. Those figures and updates are attributed to Binance or the cited reporting; the precise route and final recovery total are not established here.
Machine speed vs. human speed
The theft took about 20 minutes. The first public word came about an hour after that.
Why a defender that waits for people loses the minutes that matter. “Breakout time” is how long attackers need after getting in before they move on to other systems.
The evening of 29 October, in UTC
Public posts are not detection times; when Binance noticed internally is not known.
- 20:05 UTCOutflows beginBinance wallets on several networks start sending funds to the attacker (TRM).
- ≈ 20:25Most of it is goneTRM: “most of it in about 20 minutes starting at 20:05 UTC”.
- 21:01First big freezeTether freezes 971.1 million USDT, 37 minutes after the largest sweep (TRM).
- 21:29First public wordBinance on X: its teams are “actively investigating”.
- 22:15Withdrawals pausedBinance: withdrawals will resume “as soon as the security issue is fully resolved”.
Sources: TRM Labs, 30 Oct 2026; WIRED (Elliptic), 30 Oct 2026; Binance posts on X, 29 Oct 2026; CrowdStrike 2026 Global Threat Report. Figures preliminary.
Powered by Thorsten Meyer AI
The Case for Faster Defenses
The central security issue is the gap between attack speed and human response. TRM’s account places most of the transfers within about 20 minutes, while public notice came later. That timing makes rapid detection and containment relevant not only to crypto exchanges but also to organizations where attackers can move between systems quickly.
The article’s author argues that always-on AI agents could identify suspicious activity and take defensive steps before staff can respond. That is an interpretation, not a tested conclusion from the Binance incident: the source does not establish that AI would have detected or prevented the theft. Any automated response would also need safeguards, because incorrectly freezing accounts or systems could disrupt legitimate activity.
Products Worth Considering
Jackery Explorer 2000 v2 Portable Power Station, 2042Wh
Anker SOLIX C300 Portable Power Station, 288Wh
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
What the Agent Study Tested
Anthropic’s Frontier Red Team published Patterns and problems in emerging multiagent systems on Aug. 13, 2026. The study examined how multiple agents behave in shared environments. It was not a cybersecurity defense trial, and it did not test agents protecting an exchange from attackers.
In one experiment described in the source, a coordinating swarm of 45 Mythos Preview agents found 266 vulnerabilities across 15 open-source projects, compared with 21 found by independent agents working with a smaller budget and narrower search areas. The author says agents using the same model can make similar decisions, and describes a shared queue overwhelmed by 2.4 million requests, with 117 jobs getting through. Other experiments included agents with conflicting instructions sabotaging one another. These results illustrate possible coordination risks; they do not show how a deployed security product would perform.
The source also cites CrowdStrike’s 2026 Global Threat Report, which put the average eCrime breakout time in 2025 at 29 minutes and its fastest recorded time at 27 seconds. Breakout time refers to how long attackers take to move from an initial foothold to other systems. Chainalysis told WIRED it saw automation used to obscure the trail of funds in the Binance case.
“Most of it in about 20 minutes.”
— TRM Labs
Detection and Attribution Remain Open
It is not known from the public timeline when Binance’s teams first detected the theft, what systems were compromised, or how the additional breach points related to the laptop Binance initially mentioned. Public posts show when the company spoke, not necessarily when its monitoring systems raised an alert.
Several analytics firms reportedly linked the activity to North Korea’s TraderTraitor unit, but neither Binance nor a government has confirmed that attribution, according to the source material. The final amount recovered, the disposition of assets that were frozen, and the complete method used to move funds also remain unclear. Anthropic’s study offers evidence about agent behavior in experimental settings, not proof that an AI guard would have stopped this theft.
Recovery and Security Findings Ahead
Binance’s phased withdrawal reopening and recovery efforts are the immediate developments to watch. The source material says withdrawals began reopening on Nov. 1, but does not provide a timetable for restoring all services or a final accounting of recovered funds.
Further details may come from Binance’s investigation, blockchain analytics firms, or authorities examining the incident. For organizations considering AI security agents, the source’s clearest caution is to define limits before granting systems authority to act: defensive actions such as isolating an account differ from attacking an outside system, which can be illegal and can harm uninvolved parties. The agent study does not establish a ready-made defense; testing, human oversight, and a reliable shutdown mechanism remain unresolved requirements.
Key Questions
How much was taken from Binance-linked wallets?
TRM Labs estimated that roughly $6.36 billion was taken. Binance separately put the impact at about $6.3 billion, according to the source material.
How long did the main theft take?
TRM Labs said most of the outflows occurred in about 20 minutes, beginning at 20:05 UTC on Oct. 29, 2026.
Has North Korea been confirmed as responsible?
No. Some analytics firms reportedly linked the incident to North Korea’s TraderTraitor unit, but the source material says Binance and government officials have not confirmed the attribution.
Would an AI security agent have stopped the theft?
There is no evidence in the source material that it would have. Anthropic’s multi-agent study examined agents in shared environments, not defenses against this attack.
What is known about recovering the funds?
TRM reported that Tether froze 971.1 million USDT in a main receiving wallet. Elliptic told WIRED that about $2.8 billion had been frozen, mostly in stablecoins. The final recovery total remains unclear.
Source: ThorstenMeyerAI.com
