Changpeng Zhao has called for a crypto security alliance that would let exchanges and other companies share threat intelligence, conduct cross-audits and freeze stolen assets more quickly, following Binance's disclosure of an Oct. 29 breach involving a compromised employee device and the use of an internal AI tool by attackers.
Speaking on the Talking Tokens podcast in his first public interview since the incident, Zhao said cyberattacks are accelerating as criminal groups adopt artificial intelligence tools. He argued that security failures at major crypto companies can now create risks that extend beyond a single platform, given the sector's connections to stablecoins, tokenized shares, real-world assets and conventional financial institutions.
Binance said the attackers gained access by posing as recruiters in a fake job interview and compromising an employee's computer. The exchange said the intrusion then involved its internal AI tool, illustrating how ordinary workplace processes and new software systems can become entry points for sophisticated attackers.
Zhao said he was in the United Arab Emirates when he learned of the breach around midnight. He focused on public communications while Binance's operational teams worked on containment and user protection, he said on the podcast.
Binance cites North Korea-linked threats
Binance said it had identified and stopped 57 suspected North Korea-linked cyber threats during 2026. The disclosure places the Oct. 29 incident within a familiar pattern for the industry: North Korea-linked groups have repeatedly targeted crypto companies, employees and service providers, often using social engineering rather than attempting to break blockchain cryptography directly.
Fake recruitment campaigns have become a recurring tactic in such operations. Attackers can use job offers, interview software, coding assignments or documents to persuade an employee to download malicious software or disclose access credentials. Once inside a corporate network, they may seek systems that hold private keys, payment controls, customer data or internal communications.
The reported use of an internal AI tool adds another layer to that threat model. AI systems can help employees search information, write code and automate routine work, but access controls around those tools can become critical if an intruder reaches a staff member's machine. Zhao's remarks suggest crypto firms will need to treat AI-connected workplace software as part of their core security perimeter rather than as a separate productivity function.
Zhao proposes shared defenses
Zhao said security should be treated as a continuous process rather than a task completed through a one-time audit. His proposed alliance would create channels for firms to exchange lessons from breaches, compare security practices and coordinate responses when stolen assets move across platforms.
A faster coordinated response could be especially useful when stolen funds are transferred through multiple wallets, bridges and services within hours of an attack. Exchanges can sometimes freeze assets when they reach identifiable accounts, but the chance of recovery generally declines as funds are converted, split into smaller transactions or moved across blockchains.
The proposal also reflects the operational interdependence of large crypto firms. Stablecoin issuers, custodians, blockchain analytics providers, wallet developers and exchanges each see different parts of a transaction trail. Sharing actionable indicators of compromise, such as malicious domains, wallet addresses or known attacker techniques, could give other firms time to block related activity.
Zhao described many security lapses as preventable with sufficient attention and resources. That assessment places responsibility on firms to strengthen employee training, access controls and incident-response systems, even as attackers improve their methods.
AI-assisted attacks add pressure to security teams
Chainalysis recently disclosed an AI-assisted breach, adding to concern that attackers are using generative AI to make phishing messages, impersonation attempts and reconnaissance more convincing and easier to scale. Automated tools can help criminals tailor messages to particular employees, imitate business language and test multiple approaches quickly.
The Brazilian exchange Mercado Bitcoin also suffered a reported $46 million security incident, according to the material provided. Taken together with Binance's disclosure, the incidents underline that attackers are targeting operational weaknesses around crypto services, rather than relying only on vulnerabilities in smart contracts or blockchain protocols.
Chainalysis reported in its 2025 crypto crime report that stolen cryptocurrency funds reached $2.2 billion during 2024. The figure covered losses from hacks across the sector and showed that cybercrime remained one of the industry's largest practical risks despite improvements in blockchain tracing and exchange compliance controls.
The available information does not establish a loss figure for Binance's Oct. 29 incident. Binance said its teams moved to contain the breach and protect users, while Zhao's comments focused on the need for a coordinated industry response.
Political scrutiny follows the breach
Zhao said he had not discussed the incident with President Donald Trump or other U.S. officials. Trump had previously said the United States was looking into it, according to the material provided.
The episode arrives as crypto companies increasingly operate alongside conventional financial infrastructure. Stablecoins are used in payments and settlement systems, tokenized products are being introduced by established financial firms, and crypto custodians manage assets for a broader range of customers. Those links raise the cost of operational failures, especially when an attack affects a major platform with extensive market connections.
Zhao's proposed alliance would not eliminate the underlying problem of compromised devices and manipulated employees. It could, though, give firms a more organized way to react when those defenses fail, particularly if participants agree in advance on how to share threat data, identify suspicious transfers and request rapid freezes across platforms.
Concerned about rising crypto hacks? Strengthen your defenses with these crypto safety standards every trader should know today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
