• Changpeng Zhao (CZ) warns that AI-driven cyber threats pose systemic risks to the global financial system, suggesting banks may be more vulnerable than crypto exchanges.
  • Binance is recovering from a reported $6.3 billion theft, but no evidence links AI to the attack; industry data shows banks face rising cyber intrusions.
  • Zhao's comparison remains contested as regulators and analysts emphasize shared operational resilience across traditional and digital finance.

Changpeng Zhao, founder and former CEO of Binance, has warned that artificial intelligence is fueling increasingly sophisticated cyber threats that could destabilize the global financial system. Speaking in a recent interview, Zhao argued that banks may be more vulnerable to such attacks than cryptocurrency exchanges, though his claim remains a matter of debate.

The warning comes as Binance, the world's largest crypto exchange, is recovering from a reported $6.3 billion theft. On November 3, co-CEO Richard Teng said the exchange was in "very strong financial health," with withdrawals largely normalized after an initial surge and 95% of affected tokens replenished. Customers had withdrawn a net $4.72 billion through Monday—approximately 3% of assets on the platform—according to Binance. These are management's statements, not an independent solvency assessment.

Investigators are examining operational controls, not broken blockchain cryptography. Reporting describes a compromised laptop, malware and manipulation of transaction-approval systems that enabled unauthorized transfers from a Binance-controlled hot wallet. Binance has promised a post-mortem; the full technical account remains outstanding. AI involvement in the Binance theft has not been established. TRM Labs investigator Nick Carlsen said the firm lacked specific evidence that AI was used in this attack, even as analysts view AI as an increasingly important tool for sophisticated hackers. Separately, CrowdStrike (NASDAQ:CRWD) linked recent attacks on South Korean banks to an amateur using AI chatbots and open-source models.

Zhao's warning highlights a credible systemic risk: AI can help attackers scale phishing, impersonation and software exploitation across both banks and cryptocurrency platforms. But his suggestion that banks may be more vulnerable than crypto exchanges is an opinion—not a conclusion established by comparable industry-wide data. The IMF identifies banks as the most exposed institutions within the financial sector, but attack counts alone do not measure vulnerability per institution, per customer or per dollar held. Crypto losses can be harder to contain: confirmed blockchain transfers generally cannot be reversed, whereas bank transfers may encounter intermediary checks or sometimes be recalled. Some token issuers can freeze stolen assets, but that is not a universal recovery mechanism.

CrowdStrike's 2026 financial-services report, covering April 2025–March 2026, found that hands-on-keyboard intrusions against financial institutions rose 43% globally over the preceding two years. It also found North Korea-linked groups expanding operations against exchanges, fintech firms and traditional banks. These figures describe CrowdStrike's observed activity, not a complete census of global attacks.

The FBI has attributed the Binance theft to North Korea; Pyongyang has denied responsibility. Analysts see cryptocurrency theft as an important funding channel for North Korean weapons programs and anticipate possible additional measures against wallets, laundering networks and facilitating exchanges.

Regulatory frameworks are evolving to address these risks. The EU's Digital Operational Resilience Act, applicable since January 17, 2025, sets common operational-resilience expectations for traditional finance and regulated crypto-asset service providers under MiCA. For Binance, this cyber incident sits alongside a separate compliance history: its November 2023 US resolution imposed approximately $4.3 billion in penalties and forfeiture, remediation obligations and an independent compliance monitor. Those were anti-money-laundering and sanctions matters, not findings about this cyberattack.

The immediate test for Binance is its technical post-mortem, completion of asset replenishment, sustained withdrawal availability and whether customer flows remain stable after promotional incentives. Management's assurances are encouraging for immediate confidence, but the unresolved technical findings limit conclusions about recurrence risk. Longer term, CrowdStrike expects advancing AI models to increase attackers' sophistication, scale and speed. The IMF has warned that the most consequential outcome would be an incident that simultaneously disrupts critical services and confidence across interconnected institutions—not merely a larger isolated theft.

The evidence supports Zhao's broad warning about AI-amplified financial cyber risk. It does not yet substantiate either the narrower claim that banks are generally more vulnerable than exchanges or that AI caused Binance's latest reported theft. Binance did not respond to a request for comment on Zhao's remarks.

Update: This article was updated to clarify that Zhao's comparison of bank and crypto exchange vulnerability is an opinion, not an established conclusion.