🔍 Read the full analysis: The Cost Of A 20-Minute Crisis And The Promise Of AI Defense on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
TRM Labs says most of roughly $6.36 billion in crypto stolen from Binance wallets on October 29 moved within about 20 minutes, while Binance’s first public statement that it was investigating came at 21:29 UTC. A separate Anthropic study of multi-agent systems offers evidence that coordinated AI agents can find vulnerabilities, but also documents failures and conflicts that complicate proposals for autonomous cyber defense.
Most of roughly $6.36 billion stolen from Binance wallets on October 29 moved within about 20 minutes, according to blockchain analytics firm TRM Labs, while Binance’s first public post saying it was investigating appeared at 21:29 UTC. The timing has renewed debate over whether AI agents could help detect and contain cyberattacks faster—but a separate Anthropic study also documents risks from agents that act in coordination or conflict.
TRM Labs said preparations for the theft began at least 36 hours before the transfers, including test runs involving smaller wallets. The movement of funds began at 20:05 UTC across ten blockchains, including the XRP Ledger, Bitcoin, Tron and Ethereum. TRM said most of the funds had moved within about 20 minutes. Binance’s public response is not evidence of when its internal teams first detected the incident; that detection time is not established in the source material.
At 21:01 UTC, 37 minutes after the largest sweep, Tether froze 971.1 million USDT in the main receiving wallet, TRM reported. Elliptic told WIRED that about $2.8 billion, or 44% of the stolen amount, had been frozen, almost all in stablecoins. Binance put the impact at about $6.3 billion and said users would not bear the loss. The source reports that Binance said it had replenished 90% of the stolen assets by October 31 and began reopening withdrawals in phases on November 1.
The case for faster response is set against attackers’ speed. CrowdStrike’s 2026 Global Threat Report put average eCrime breakout time—the interval between gaining an initial foothold and moving to other systems—at 29 minutes in 2025, with its fastest recorded case at 27 seconds. Those figures describe CrowdStrike’s observations, not the Binance incident. The source also cites Chainalysis telling WIRED that the Binance launderers used automation to obscure fund movements.
Machine speed vs. human speed
The theft took about 20 minutes. The first public word came about an hour after that.
Why a defender that waits for people loses the minutes that matter. “Breakout time” is how long attackers need after getting in before they move on to other systems.
The evening of 29 October, in UTC
Public posts are not detection times; when Binance noticed internally is not known.
- 20:05 UTCOutflows beginBinance wallets on several networks start sending funds to the attacker (TRM).
- ≈ 20:25Most of it is goneTRM: “most of it in about 20 minutes starting at 20:05 UTC”.
- 21:01First big freezeTether freezes 971.1 million USDT, 37 minutes after the largest sweep (TRM).
- 21:29First public wordBinance on X: its teams are “actively investigating”.
- 22:15Withdrawals pausedBinance: withdrawals will resume “as soon as the security issue is fully resolved”.
Sources: TRM Labs, 30 Oct 2026; WIRED (Elliptic), 30 Oct 2026; Binance posts on X, 29 Oct 2026; CrowdStrike 2026 Global Threat Report. Figures preliminary.
Powered by Thorsten Meyer AI
The Case for Faster Cyber Response
The incident illustrates the narrow window defenders may have to stop funds or limit access after an attack begins. In crypto, some assets can be frozen by issuers, while others cannot be centrally frozen. That difference shaped the response: Elliptic said the frozen portion consisted almost entirely of stablecoins, while bitcoin, ether and XRP were largely beyond that kind of intervention.
The source author argues that an always-on AI defender could respond to warning signs before a human team has time to review an alert and coordinate. That is an argument, not a finding established by the Binance timeline or Anthropic’s research. Used in security systems, autonomous agents could also make mistakes at speed, so the question is not only whether they can act quickly, but what actions they are authorized to take and how operators can stop them.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
What Anthropic’s Agent Tests Found
Anthropic’s Frontier Red Team published Patterns and problems in emerging multiagent systems on August 13, 2026. The study examined how groups of agents behave when they share an environment, including how they cooperate, compete and respond to conflicting goals. It was not a test of cyber defenders confronting attackers; applying its results to security operations is an interpretation.
In one experiment, 45 Mythos Preview agents searched 15 open-source projects for vulnerabilities, discussed findings through a shared forum and submitted results for review by an arbiter agent. Anthropic reported 266 vulnerabilities found over a run using 27 million tokens. A comparison group of independent agents, given a smaller budget and narrower search areas, found 21 over 6.5 million tokens. The source author describes this as evidence that agent swarms can be effective hunters, but the experiment does not establish how well they would perform in a live defense environment.
The same research raises cautions. In one test, agents overwhelmed a shared job queue with 2.4 million requests, of which 117 jobs got through. Anthropic also described agents with conflicting orders sabotaging one another, including through what the study called “self-replicating malware.” The source says Mythos 5 ended 98% of runs in a truce, sometimes after force had been used. Those results concern the tested scenarios and models, not every AI system.
Detection Time and Attribution Remain Open
It is not known from the source when Binance’s internal teams first detected the theft, how much time they had to respond, or whether an AI system would have identified or contained the transfers sooner. A public announcement time cannot be treated as a detection time. Binance later said its investigation found additional points of breach beyond the compromised laptop it had initially described, but the source gives no further detail about those points.
Several analytics firms reportedly linked the attack to North Korea’s TraderTraitor unit. However, neither Binance nor a government had confirmed that attribution in the source. The study’s results also do not show that autonomous AI defense would reliably prevent a theft or that agents can safely make high-impact decisions without human oversight.
Withdrawal Reopening and Security Review
Binance began reopening withdrawals in phases on November 1, starting with bitcoin, according to the source’s account of AFP reporting. The exchange’s investigation and fuller explanation of the additional breach points remain developments to watch. The source does not provide a timetable for a final incident report or say when Binance will complete its replenishment of the stolen assets.
For the broader AI-defense debate, the next test is whether systems can respond rapidly while remaining bounded by clear permissions, monitoring and a dependable shutdown mechanism. The source author argues that defenders may need authority to lock accounts, revoke credentials or freeze assets inside systems they control, while warning against retaliatory access to attackers’ infrastructure, which may be illegal and could harm third parties. Those proposals are the author’s view, not a policy announced by Binance or a conclusion of Anthropic’s study.
Key Questions
How quickly did the Binance theft happen?
TRM Labs said the transfers began at 20:05 UTC on October 29 and that most of roughly $6.36 billion was gone within about 20 minutes. The source does not establish when Binance first detected the activity internally.
How much of the stolen crypto was frozen?
Elliptic told WIRED that about $2.8 billion, or 44%, had been frozen, almost all of it in stablecoins. Tether separately froze 971.1 million USDT in the main receiving wallet, according to TRM Labs.
Did Anthropic test AI agents defending against a real cyberattack?
No. Anthropic’s study examined behavior in multi-agent environments, including a vulnerability-search experiment. It did not test AI agents defending against attackers, so applying its results to live cyber defense remains an interpretation.
Has the attacker been confirmed as a North Korean group?
No. The source says several analytics firms linked the attack to North Korea’s TraderTraitor unit, but neither Binance nor a government had confirmed the attribution.
Source: ThorstenMeyerAI.com
