The Binance hack on October 29 was the largest cryptocurrency theft ever recorded: about US$ 6.3 billion left the exchange's wallets in a few hours. Based on what Binance has disclosed so far, the attack may have started on the compromised laptop of a DevOps engineer, not with broken cryptography. If a company with a dedicated security team falls through its day-to-day infrastructure, software assembled only through vibe coding, with no one who understands infrastructure, programming and security, is the easiest target on the market.
Quick answer
- What happened? On October 29, Binance wallets on about ten blockchains were drained. Binance estimates the loss at US$ 6.3 billion and suspended withdrawals on several networks.
- How did they get in? According to Binance, the attacker may have used an engineer's laptop to reach an internal service and submit unauthorized withdrawals. The company says no private key was leaked. The full post-mortem has not been published yet.
- Who did it? Blockchain analytics firms point to the North Korean group TraderTraitor (linked to Lazarus). So far, no government has officially confirmed the attribution.
- Will customers lose money? Binance says it will cover all losses with its SAFU emergency fund and its own funds. Stablecoin issuers froze close to US$ 3 billion linked to the attack.
- What does this have to do with your company? The attackers operate like a state operation: they rehearse, automate and look for the weakest link. AI-generated software with no technical review usually ships exactly the flaws this kind of attacker looks for first.
What we know about the Binance hack so far
The attacker's wallet was funded a day earlier with small withdrawals from a crypto mixer. On the 29th, the attack code was tested hours before it ran. Around 8 p.m. UTC, Binance wallets on the XRP Ledger sent 233 million XRP to a single address. Over the next half hour, hot wallets on other networks were drained, including a single US$ 2.5 billion ether transaction. A second wave hit Avalanche and Polygon late that night.
The on-chain records suggest the attacker did not steal the keys: it managed to give orders to the exchange's own signing infrastructure. In other words, the system signed and sent the transfers because the request came from inside, through a path that was supposed to be trusted.
The response was fast on one front: Tether locked more than US$ 1 billion in USDT in the attacker's main wallet in under 40 minutes, and Circle froze more than 800 million in USDC. Even so, more than US$ 3 billion remains beyond the issuers' reach. The figures are still preliminary and vary between sources.
This is the second major case in the crypto market in a few weeks. In September we had already analyzed what the September hacks reveal about risk and governance.
Not just Binance: governments were hit in October too
In the same week, three public bodies confirmed serious incidents:
- Moldova: between October 19 and 23, data linked to about 750,000 personal identification numbers was extracted from the state's digital services. The government shut down 82 public services and more than 30 systems to contain the attack. The agency in charge said services were reachable without authentication.
- United States (Department of Homeland Security): a group published data on more than 40,000 employees and contractors. The attacker says the records came from the single sign-on system the agency uses. The sign-on vendor denies being breached, and the way in has not been clarified.
- Florida (Department of Education): the student financial-aid portal suffered unauthorized access identified on October 19, possibly exposing data on 4.9 million people, including Social Security numbers.
The pattern repeats: credentials, access and configuration. In none of these cases was the confirmed problem broken cryptography. It was an open door or a key that was trusted too much.
Why this is a warning for anyone buying software built with AI
Attacks like the one on Binance are carried out by professional, funded teams that rehearse before acting and launder money in minutes. On the other side, the market is going through a wave of software built with vibe coding: someone describes what they want to an AI, accepts the generated code and publishes it, without reading, reviewing or understanding what was delivered.
AI writes code fast, and that has value. The problem is on the buying side: many companies are handing the system that stores customers, orders, payments and personal data to vendors or freelancers who cannot evaluate what the AI wrote. Without a background in infrastructure, programming, security and architecture, nobody notices that the system works in the demo and is open to anyone on the internet.
And the same technology that generates code in minutes also helps scan code in minutes. The cost of finding a flaw has dropped for attackers. A basic flaw is no longer a theoretical risk; it is a target for automated scanning.
Vibe coding cases that have already gone wrong this year
- Moltbook, in January: a social network for AI agents, built with AI tools, exposed 1.5 million API access tokens and 35,000 email addresses a few days after launch. The cause was a Supabase database configured without row-level security rules.
- Lovable, from March to April: an authorization flaw on the platform let a free user read other projects' source code, profiles and database credentials with a few API calls. The flaw stayed open for 48 days after it was reported. The company disputes this and says there was no data breach.
- Catalogued vulnerabilities: Georgia Tech researchers counted 35 official vulnerabilities (CVEs) caused by AI-generated code in March alone, up from 6 in January, and estimate the real number is much higher.
The most common flaws in software built only through vibe coding
They are almost always the same, and all of them are invisible to anyone who only tests by clicking through the screens:
- API key or database password inside the browser code, where any visitor can read it.
- Database with no access rules: the screen shows only your orders, but the API returns everyone's orders.
- Authorization that checks the login but not who owns the data: changing a number in the URL is enough to see another customer's record.
- Payment webhooks with no signature verification: someone fakes the confirmation of a payment that never happened.
- Secrets in the repository and a server with everything exposed: admin panel, database port and logs open to the internet.
- No logs, no tested backup and no response plan: when the incident happens, nobody knows what leaked or since when.
Every item on this list involves personal data and, therefore, data protection law. A leak caused by a basic flaw is not bad luck; it is a lack of care that the law holds companies accountable for. See how to prepare your company website to collect data securely.
Professional who uses AI × vibe coding with no technical background
| Point | Professional who uses AI | Vibe coding with no technical background |
|---|---|---|
| Generated code | Read, reviewed and understood before going live | Accepted because "it worked" |
| Architecture | Defined upfront: what stays on the server, what stays in the browser | Whatever the AI decided at the moment |
| Data access | Rules per user and per record, tested | Relies on the screen to hide the data |
| Secrets and keys | On the server, rotated, with least privilege | In the code, in the repository, in the browser |
| Infrastructure | Locked-down server, tested backup, monitoring | Default settings from whoever created the account |
| When something breaks | Knows where to look and what to shut down | Asks the AI to "fix it" and hopes |
The difference is not whether AI is used. We use AI every day. The difference is having someone who takes technical responsibility for what goes into production.
7 questions to ask before buying a system
- Who reviews AI-generated code before it goes live, and by what criteria?
- Where are API keys, database passwords and payment tokens stored?
- How does the system make sure one customer cannot see another's data?
- Which server does the system run on, who manages it and who applies security updates?
- Is there an automatic backup? When was the last restore test?
- Which accesses are logged, and for how long?
- If an incident happens on a Friday night, who responds and what is the first step?
If the answers are vague, the low price is charging you somewhere else. To compare vendors with clear criteria, see software house, freelancer or in-house team: how to decide safely and how to choose a software house with strategic criteria.
Already have a system built this way? Where to start
- Look for exposed secrets: open the system in the browser, inspect the loaded code and the repository. Any key you find must be rotated immediately.
- Test access between users: create two accounts and try to see one account's data from the other, changing identifiers in the URL and in the API calls.
- Review the database rules: on services such as Supabase and Firebase, confirm that access rules are enabled on every table.
- Lock down the server: only the necessary ports open, admin panel protected and updates current.
- Turn on logs and backups: and run a real restore test.
- Ask for an independent technical review by someone who did not write the system.
Frequently asked questions
Was Binance hacked because of vibe coding?
There is no indication of that. Based on what has been disclosed so far, the way in was an engineer's laptop and the abuse of an internal service. The point is a different one: if a company of this size falls through its day-to-day infrastructure, a system with no technical review at all is far more exposed.
Will Binance customers lose money?
Binance says user funds are safe and that it will cover all losses with the SAFU fund and its own funds. Withdrawals were temporarily suspended on some networks as a precaution.
Is vibe coding always bad?
No. For a prototype, an idea test or an internal tool with no sensitive data, it can be great. The risk appears when the code goes into production with customer data, payments or integrations, without anyone with a technical background reviewing it.
How can I tell whether my vendor uses AI without review?
Ask the 7 questions above. Those who really review answer with names, tools and processes. Those who don't answer that "the system is secure" without saying how.
Is software built with AI secure?
It can be, as long as someone with knowledge of security, infrastructure and architecture defines the structure, reviews the code and maintains the server. Security comes from the process, not from the tool that wrote the code.
Fast technology, with technical responsibility
We use AI to deliver faster, with reviewed code, architecture defined before the first line and servers managed by people who answer for them. That is how we do custom web system development and the management of high-performance cloud servers. If your system was built in a hurry and you want to know how big the risk is, talk to our team.
Sources
- Elliptic — The largest theft in history: North Korea likely behind the Binance hack
- TechCrunch — Binance pauses withdrawals as hackers suspected of stealing billions in crypto
- InfoMoney — Hackers desviam US$ 6,3 bi da Binance no maior roubo de criptomoedas da história
- Pasquale Pillitteri — Moldova cyberattack: 750,000 people's data stolen
- Pasquale Pillitteri — Ataque hacker ao DHS, dados de 40.000 funcionários roubados
- Nossa Gente — Ataque hacker atinge Departamento de Educação da Flórida
- The Next Web — Lovable security crisis and the structural failure of vibe coding security