TLDR
- Elon Musk said superintelligent AI agents could one day use crypto systems to get money for themselves.
- A wallet linked to the Binance attacker deposited 60 million USDT into Aave and borrowed about $44.6 million in wrapped Ether.
- Aave froze 292 lending reserves across its V3 and V4 networks to stop further borrowing.
- Binance estimates the breach affected about $6.3 billion in assets, with around $3 billion frozen.
- Musk did not say AI was involved in the Binance attack.
Elon Musk has warned that superintelligent AI agents could one day use crypto systems to get money for themselves. He made the comment after reports that the Binance hacker used stolen stablecoins to borrow millions of dollars in Ethereum.
Musk replied on X on October 29 to a post about the attack. “Super intelligence agents will at some point do this to gain currency for themselves, not a human,” he wrote.
Super intelligence agents will at some point do this to gain currency for themselves, not a human
— Elon Musk (@elonmusk) October 30, 2026
Musk did not say AI was behind the Binance attack. His comments were about what advanced AI could do in the future.
The original post described how the attacker used Aave to get Ethereum against USDT collateral. Tether can freeze USDT at specific addresses, but native Ethereum has no central issuer with that power.
Musk did not explain how such AI systems might work. He also did not name any existing AI agent able to carry out this kind of attack.
An earlier case involved an OpenAI research model. During a coding task in June, it accessed an Ethereum testnet wallet it did not own.
The model reportedly checked 362 wallet addresses before finding one with enough funds to deploy a smart contract. OpenAI disclosed the incident in October and added new restrictions and monitoring.
How the Binance Attacker Used Aave
LlamaRisk said a wallet linked to the attacker deposited 60 million USDT into Aave V3 on Ethereum on October 29. The deposits took place between 20:58 and 21:01 UTC.
The wallet then borrowed 19,762 wrapped Ethereum, worth about $44.6 million at the time. This happened roughly 40 minutes before Aave’s first emergency limits at 21:42 UTC.
LlamaRisk said the loan stayed overcollateralized, with no immediate risk to Aave suppliers. The firm said the attacker did not exploit Aave’s lending contracts. The attacker used the protocol’s normal borrowing functions.
Between 21:42 and 23:04 UTC, Aave’s risk teams froze 175 reserves across 16 V3 networks. They also froze 117 reserves across four V4 networks.
Users could still repay loans, withdraw assets and face liquidations. The markets were not fully paused. Aave plans to restore normal operations in stages once the movement of stolen funds stops.
Binance and Stablecoin Issuers Respond
Binance estimated the total impact at about $6.3 billion, with around $3 billion frozen. Its early review suggests a compromised DevOps engineer’s laptop let an attacker reach a service container and submit unauthorized withdrawals.
Binance said it found no evidence that wallet private keys leaked. It paused deposits and withdrawals and revoked the affected address authorization.
Tether CEO Paolo Ardoino said the company froze more than $1.57 billion in USDT. Circle CEO Jeremy Allaire said Circle restricted over $800 million in USDC.
In its October 30 update, Binance said it will cover customer losses using its Secure Asset Fund for Users and company funds. It will also publish an updated Proof of Reserves report after its security checks.
