TRM Labs: AI Agent KYC Must Begin with Human Controller

Using a fake job interview to deceive staff, North Korean hackers stole roughly $6.3 billion from Binance last week, also exploiting an internal AI tool. Within 20 minutes, most of the funds had been moved.

The Binance incident demonstrated the speed at which criminals can transfer large sums. Meanwhile, as AI agents start handling payments autonomously, financial firms face a new question: who bears responsibility when software manages the funds?

Speaking at Merge Madrid, TRM Labs's Guillaume Rodenas offered a straightforward answer.

“I think as long as you can actually verify the principal, so essentially the one who controls the agent who has the mandate, I think you’re probably in a good position.”

In essence, the person or firm behind the AI agent should be verified. The agent's transaction record then shows what actions it took on their behalf.

Who Bears the Cost When AI Errors Occur?

“That’s obviously kind of the million-dollar question, right?” Rodenas admitted.

Rodenas proposed that developers could be liable for bugs in the software. Users, meanwhile, need to understand the financial protocols they use.

Decentralized autonomous organizations (DAOs) add further complexity to accountability. Rodenas connected that uncertainty to why Europe's MiCA rules largely exclude fully decentralized finance.

At the same time, criminals already outpace conventional security teams in speed.

TRM Labs estimates that North Korea was behind 85% of the value stolen in crypto hacks this year, with total losses reaching a record $8.7 billion, largely driven by Binance.

Century-Old Banks: Ready for On-Chain Risk?

Rodenas noted that criminals are increasingly using autonomous agents to interact with protocols and execute round-the-clock transactions. AI has also featured in attacks on conventional banks.

“So if the crime happens twenty-four-seven, the defenders have to work twenty-four-seven too.”

TRM already deploys AI for continuous wallet monitoring and suspicious activity detection. Yet Rodenas sees a different challenge among European banks: their willingness to adapt.

“There are some differences in readiness, but there’s mostly differences in willingness.”

Some banks have dedicated blockchain teams. Others still have employees struggling to convince management that digital assets matter.

Rodenas believes the line between crypto and traditional money will eventually fade.

“I think in a few years from now we’ll probably just stop calling it crypto, digital assets or whatever the case may be. It will be just a new form of asset, and we’ll just call it money, right?”

That future poses an immediate challenge for banks: preparing for a financial system where software moves money without waiting for human instructions.