Experts briefing Trending Topics — including Check Point, AMLBot, EXANTE and Teroxx — agree the record theft succeeded without breaking any cryptography: the attackers took over the withdrawal-initiation system through a compromised DevOps engineer's laptop.

EXANTE chief technology officer Richard Forss told Trending Topics that calling it a hack 'flatters the attacker,' since no private keys were stolen and valid signatures moved the funds.

AMLBot CEO Slava Demchuk framed the core failure as the gap between a cryptographically valid transaction and an authorised one, asking how exchanges can protect such sums when the systems initiating transactions cannot be trusted.

While no evidence shows AI was used, analysts warn the technique scales dangerously with it.

Trending Topics reports that Check Point's Thomas Boele said AI makes fake-recruiter deception — rigged coding tasks and infected repositories long used by North Korean-linked crews — cheaper, faster and more convincing, and that Forss expects state-backed teams to run hundreds of believable personas with fluent messages and real-time video.

Teroxx researcher Leonardo Larieira called the case a turning point and possibly the clearest preview yet of attacks in the AI age.

The National adds that Immunefi's Goncalo Magalhaes said AI has made finding weaknesses cheap while fixing them still runs at human speed, and that defenders are using the same technology.

About $3 billion has been frozen, largely in Tether and Circle stablecoins, but Demchuk told Trending Topics the recovery process is broken: issuer freezes take two to three minutes while unfreezing requires law enforcement or court orders that can take months or years.

He also described laundering patterns never seen before — thousands of automated transactions in short windows, looping money back to addresses used earlier — though the looping triggers compliance tools that flag it, with cashing out happening through OTC desks and peer-to-peer services in the grey zone.

Experts told Trending Topics that multisignature and secure key storage are no longer sufficient: exchanges need independent transaction-policy enforcement outside the infrastructure that signs withdrawals, with velocity and aggregate-exposure checks before authorisation.

Forss warned the next incident may not need a laptop at all, since firms are giving AI agents access to payment systems faster than they are setting limits, and prescribed treating every person and agent as already compromised.

The Vault's Yury Derbasov advised retail holders to use cold storage, security keys instead of SMS, and withdrawal allow-lists — advice echoed for institutions by The Vault, whose CEO Artem Stopnevich said pre-Binance 2026 losses of about $2.7 billion were already more than doubled by this single attack.