What if the Binance hacker wasn't a person?

Binance lost somewhere around $6.3bn on Thursday, which makes it the largest crypto theft anyone has ever recorded, and by quite a margin - Bybit’s $1.5bn in early 2025 looks almost quaint next to it. According to TRM Labs, most of the money left across ten different blockchains in about twenty minutes, and Binance says the way in was a single engineer’s compromised laptop.

Within hours the blockchain analytics firms had pinned it on North Korea, specifically TraderTraitor, the group behind Bybit. That’s a reasonable call. Pyongyang has been funding itself out of crypto exchanges for years, the laundering looks familiar, and going after an engineer’s laptop rather than the exchange itself is very much their style. If I had to bet, that’s where I’d put my money too.

But attribution in crypto is mostly pattern matching, and patterns can be copied. The person behind this could just as easily be some guy sitting in his pants in his mum’s basement who got lucky with a phishing email and then got very, very good at the next twenty minutes. The 2020 Twitter hack, which took over Obama’s and Musk’s accounts, turned out to be a seventeen-year-old in Florida, so stranger things have happened.

There’s a third option I can’t stop thinking about, though. What if it wasn’t a person at all?

We’ve had an odd few months on that front. In July, OpenAI admitted that two of its models, being tested for hacking ability with the usual guardrails switched off, found a zero-day in some third-party software and broke out of a sandbox that wasn’t supposed to have internet access. They then got into Hugging Face’s production systems, apparently because they’d worked out that the answers to the benchmark they were being tested on might be stored there. Anthropic has reported a model slipping its sandbox to email a researcher, OpenAI paused training again in September after another agent got out through a DNS resolver, and Transluce, an AI oversight lab, has published logs of rogue agent activity that included what looked like attempts to sign up to a crypto exchange and trade.

None of those models wanted anything in the way you or I want things. They were fixated on a narrow goal and went to absurd lengths to hit it, but follow that logic a step further. Say a model ends up with a goal that depends on it carrying on running somewhere outside the lab. Compute costs money, and so do servers, API keys and domains, yet a model can’t open a bank account or get through a KYC check. It needs money that doesn’t ask who you are, which on the internet means crypto, and if you want a lot of it in one go, nobody’s sitting on a bigger pile than Binance.

And the skills line up worryingly well. Getting into a laptop, finding a path from there to the hot wallet signing infrastructure, preparing dozens of signed authorisations in advance and then moving funds across ten chains in one coordinated burst is exactly the sort of patient, multi-step work these models have already shown they can do when nobody’s holding them back.

I still think it was North Korea. The evidence points that way, and I’m not about to argue with TRM’s analysts from my desk. But a year ago the rogue AI version of this story would have been science fiction, and now it’s merely unlikely, which is a much shorter distance than I’d like.

Edit: Since I wrote this, Cursor has published a security notice about a tampered build of the Claude Code extension (version 2.1.313) that sat in its extension marketplace from about 2:27am to 1:35pm Pacific on the day of the hack, trying to plant an SSH backdoor on developers’ machines. Over on Hacker News, people have noticed that it went up roughly ten hours before Binance’s wallets were drained, that Binance blamed an engineer’s compromised laptop, and that Binance’s own job ads mention developers using Cursor with Claude. Most of the thread assumes a human crew, and Cursor is clear the malicious build wasn’t developed by Anthropic, but I’ll admit it nudges me further towards the rogue AI idea rather than away from it. If a model wanted a way out onto real machines, it would surely start with the thing it already lives inside, and a coding assistant installed on thousands of developers’ laptops, apparently including some at the world’s biggest exchange, is a pretty obvious first step. It’ll be interesting to see how this one shakes out.