Binance's $6.3B exploit raises questions about crypto security in the AI era

👋 Welcome to the new readers who’ve joined us since last week. You’re joining 175,000+ other subscribers who love fintech.

Hello fintech friends,

This time of year always gets me excited, as we’re just around the corner from the holidays and that means we’re only two months from the Fintech Formal 🙌

Formal invites are by application this year — you can apply to join here.

If you haven’t been, the Formal is fintech’s annual black tie gala, held on December 11th in New York to celebrate fintech’s biggest stars and successes.

We partner each year with a charity to give back to the community, and this year to celebrate our fifth year of the Formal, we’ll debut our fintech awards, The Changemakers.

The Changemakers celebrates the five most impactful companies and individuals in five categories:

We’d like to thank our fantastic judges this year:

Get your tux and gown ready and we’ll see you there 🍾

One big thought: Is crypto vulnerable to AI exploits?

The biggest story of the week is one that broke last night. Detail keep emerging and they just get wilder:

Crypto exchange Binance was the victim of a series of exploits in which hackers made off with over $6.3 billion in crypto assets.

Binance founder CZ (who is no longer operating CEO of the company, but still its primary spokeperson), was quick to say that Binance user funds were safe and not at risk. The company has a history of reimbursing users for hacks, but the largest hack to date was BNB’s October 2022 chain hack, which ‘only’ resulted in a $570M loss.

In this exploit, the hackers stole stablecoins, used them in wallets as collateral to immediately take out flash loans, and then when the collateral was frozen, disappeared with the flash loans. Tether froze $1.5B of USDT, Circle froze $800M of USDC, but the hackers used Aave to take out loans and disappeared with the loans, leaving the lending protocol with frozen collateral.

The exploit is interesting because it’s so simple.

There are interesting philosophical questions for crypto here: Is reversibility a necessary feature for crypto to be a safe store of value and transaction method? Does this require we add-back central arbitrators to all stablecoin transactions? And are KYC requirements enough to prevent bad actors in DeFi lending? Or do flash loans have a natural weakpoint in that stolen assets may not be marked frozen quickly enough to prevent the loan?

This story comes with the backdrop of two interesting trends:

First, hackers are getting increasingly effective at using AI models to detect and exploit obscure weaknesses in internet security. AI tools probably had a role to play in the Binance heist, and just this week hackers also drained $2.6M+ of funds from Polymarket and uncovered critical insecurities in PHP, a fundamental programming language used by most web applications.

As AI hacking tools become more sophisticated, crypto code exploits become more likely.

Second, more and more consumers and financial institutions are participating in crypto lending vaults in order to take advantage of attractive yields.

Per Blockworks data, more than $10 billion has been deposited into crypto vaults, up from $4 billion at the start of last year. The yields paid on stablecoins are often greater than 10%, beating the equivalent yield that institutions would realize via treasury money market funds or high-yield savings accounts.

But given the newness of the institutional DeFi lending and crypto earn ecosystem, it’s likely that many of these protocols have weaknesses in their code that can be exploited even more easily than a battle-tested exchange like Binance.

DeFi yield-chasers have no doubt taken notice of the new spate of crytpo hacks and I’d expect to see inflows reverse until better security is in-place.

We’ll also probably see asset flight to larger institutions with tighter security practices in the meantime.

And if you’re planning to build a crypto AI security provider, this is a fantastic time to fundraise.

If you missed it, you’ll notice we have a new look around here 🔥

Read more about our launch of the Financial News Network and see what comes next in our Wednesday announcement:

- Nik

SPONSORED

Moving customer money is your business.

Modern Treasury gives you named customer accounts, ACH, wires, instant payments, and a clear record of whose money is whose, all in one platform.

Bring your existing volume and the requirements your current provider can’t meet.

Join companies like Procore, Navan, Morse, and more who trust Modern Treasury to move $600B+ and counting.

See you next week 👋 - Nik