Analyzing the News: The $6.3 billion Binance hack

Thirteen outlets covered the biggest crypto theft on record. Fíor read every one of them as human.

Fíor is a natural language classifier that predicts whether a piece of text was more likely written by a person or by AI.

On 29 October, hackers took about $6.3 billion in cryptocurrency from Binance, the world's largest crypto exchange. The blockchain intelligence firm TRM Labs said the money left Binance's wallets across ten blockchains, most of it in about 20 minutes. TRM and Chainalysis linked the attack to TraderTraitor, a North Korean state hacking unit, and the FBI later attributed it to the same group. The FBI had blamed TraderTraitor for the $1.5 billion hack on the exchange Bybit last year.

Binance paused withdrawals and said it would cover customers' losses itself. Other crypto companies helped freeze about $3 billion of the stolen funds. Binance first said the attack may have started with one compromised laptop, then said it had found further points of breach. It began reopening withdrawals in stages, and customers pulled out billions as it did.

The outlets were Reuters, AP, Bloomberg, the Guardian, CBS News, TechCrunch, Business Insider, Fortune, Forbes, the Wall Street Journal, ABC News, Sky News and The Independent. That is two wire services, American and British newspapers and broadcasters, the business press and TechCrunch. The Wall Street Journal sits behind a paywall, so only part of it was scanned. The CBS News report was credited jointly to CBS and the agency AFP. The Washington Post was left out because its scan again picked up an AI-written summary of reader comments instead of the article.

The result

All thirteen read as human. None drew a writing-habit flag, and Brath said every one of them reads like a person wrote it.

TechCrunch and Fortune were the least decisive, and both still read clearly as human. Fortune's piece was an explainer, the kind of article that has sometimes read as AI in this series. This one did not.

This is the twelfth story scanned with Brath, Fíor's new model. CBS News read as human this time, but its report was shared with AFP, so it does not settle the pattern of its own reporting reading as AI. ABC News, which read as AI in its last two appearances, read as human. The Guardian read as human, and has now read as AI in seven of the fourteen stories where it ran its own reporting.

Breaking stories read as human

This is the second story in the series where every outlet read as human. The first was the Google Cloud outage. Both were breaking incidents: something went wrong suddenly, and reporters followed it as it unfolded.

That makes the obvious explanation the pace of the story. Writing that chases fresh facts, new numbers and statements by the hour leaves little room for template. It is not a rule, though. The PHP security flaws were also a breaking incident, and four of thirteen read as AI there, mostly explainers.

A story that kept moving

The facts changed as the outlets wrote. Early reports said Binance had replaced about 90% of the stolen funds. Later ones said 95%. Early reports blamed a single compromised laptop. Later coverage reported Binance's correction that the attack was more complex. Neither difference is a contradiction. Each outlet reported what was known at the moment it published.

Some of these pieces may have had AI help, with a first draft, a rewrite or a final polish. Or breaking coverage has become formulaic enough that a reporter and a model would write it the same way. Fíor cannot tell those apart on its own.

The thieves moved most of the money in about 20 minutes. The reporting took days, and changed as the facts did. Every page of it read as written by a person.

What Fíor is

Fíor is a machine learning classifier, currently in beta and available as a browser extension. It gives a prediction, not a verdict. It cannot see who sat at the keyboard, and nothing here is a claim about any journalist or publication. Reading as AI and being written by AI are not the same thing.

Treat it as a signal, not proof, and check the pages you read yourself.

Try the browser extension at Fíor.

Analyzing the News is a series where we run one major story through Fíor and see what comes back.