Key Takeaways
- Binance and Bitget breaches exposed $6.3B and $387.5M, though neither was publicly tied to AI.
- Google and Anthropic say AI agents are accelerating phishing, exploits, and credential theft.
- Crypto security now hinges on defenders keeping pace with attacks that can operate at machine speed.
AI Is Turning Crypto Theft Into a Faster, Cheaper Business
Crypto’s latest security crisis has arrived just as artificial intelligence is making cyberattacks cheaper to launch and harder to contain.
Binance said attackers caused an estimated $6.3 billion impact in an Oct. 30 breach, with its initial investigation pointing to a compromised DevOps laptop and unauthorized withdrawals. Bitget suffered another incident in September involving approximately $387.5 million transferred to attacker-controlled addresses. Neither company has publicly attributed its breach to AI.
That distinction matters. The emerging threat is not that every crypto hack suddenly uses AI. It is that AI is changing the economics of attacking wallets, exchanges and financial institutions.
AI Turns Familiar Attacks Into Industrial Operations
Google Threat Intelligence says adversaries are moving from simple AI prompting toward agentic attack workflows.
In one 2026 case, an attacker used AI agents to build and execute a mass credential-harvesting operation in less than six hours, compromising thousands of third-party credentials. Google says AI is increasingly being used for vulnerability research, exploit development, and automated reconnaissance.
Anthropic has observed the same shift. Its September threat report found attackers running parallel AI agents for reconnaissance, exploitation, and theft, allowing individual operators to manage campaigns that previously required entire teams.
Curve Finance founder Michael Egorov argues that centralized platforms face a particularly broad attack surface because they combine privileged access with complex software infrastructure.
“Centralized infrastructure is usually built using fairly complex software infrastructure dependencies where AI finds flaws almost every day now,” Egorov said.
River’s bitcoin threat map captures the problem: AI can amplify self-custody theft through phishing and malware, accelerate account takeovers using leaked data and deepfakes, and help attackers search platform code for vulnerabilities.
Bitcoin’s Self-Custody Model Creates Unique Stakes
Crypto adds an unforgiving feature: successful theft can be irreversible.
A flaw that weakened randomness in certain COLDCARD-generated seeds was linked this summer to the theft of 1,367 BTC from more than 4,500 addresses, worth nearly $116 million at the time. Attackers could reproduce vulnerable private keys offline.
Recent data leaks create another attack surface. Keystone disclosed that an October website breach exposed personal information associated with 25,964 buyer records. Coinbase separately said an incident at analytics provider Amplitude exposed contact information for a small subset of customers, although its own systems and customer funds were not breached.
Such data can become raw material for highly personalized AI phishing.
Banks Face the Same Machine-Speed Threat
Traditional finance is not insulated.
Anthropic documented AI-assisted cyber operations targeting financial institutions, while the FBI recorded more than $262 million in reported account-takeover losses from January through November 2025.
The defining security race may therefore be about speed.
AI does not need to invent a new way to steal bitcoin or empty a bank account. If it can find weaknesses, impersonate victims, and execute existing attacks faster than defenders can intervene, familiar cybercrime becomes something much more scalable.
