A security breach at blockchain intelligence firm Chainalysis and a multibillion-dollar theft at cryptocurrency exchange Binance have underscored how artificial intelligence is becoming part of the cyberattack landscape. As attackers turn AI tools against major crypto companies, Nigeria — one of the world's most active cryptocurrency markets — still lacks a legal framework to govern the technology.

The two incidents raise questions about whether the country's existing cybersecurity and data protection laws are sufficient to address attacks involving increasingly autonomous AI systems. The stakes are particularly high for Nigeria, which ranked second globally in cryptocurrency adoption in Chainalysis' 2024 Global Crypto Adoption Index.

What Has Been Confirmed — and What Has Not

Chainalysis, the blockchain intelligence firm that helps cryptocurrency exchanges, governments and law enforcement agencies trace stolen digital assets, disclosed last week that an attacker had used what it described as "offensive agentic techniques" to access its systems and internal tools.

The company confirmed that the intruder accessed user IDs, full names, email addresses and organisational role labels for some users of its platform. It reported finding no evidence that the attacker accessed investigation content, transaction or query results, passwords in clear text, multifactor authentication secrets or user session tokens.

Chainalysis has not explained exactly how the attacker used AI, which vulnerabilities were exploited, or how much of the intrusion was automated. In a later update, the firm disclosed that it had temporarily taken some products, such as Reactor and Data Solutions, offline while conducting additional security assessments.

The Binance incident is separate. The exchange reported that approximately $6.34 billion in digital assets were affected by a security incident last week. In initial findings published this week, Binance said it had frozen or intercepted about $2.85 billion in assets and promised to absorb the financial impact of the theft. How much of the remaining affected assets can be traced or frozen — and what any further findings show about how the intrusion unfolded — are the immediate details to watch as the investigation continues.

Citing information from the FBI, Binance attributed the attack to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis linked it to a group known as TraderTraitor.

The exchange's report describes a multi-stage attack involving fake recruitment interviews, malicious software, compromised employee devices and stolen credentials. It also discloses that an attacker used a compromised engineer's computer and an internal AI tool to gain control of two other engineers' machines before accessing infrastructure connected to Binance's wallet operations.

That sequence does not establish that AI independently carried out the theft. Rather, it shows how an AI-enabled internal tool can become part of an attack chain when access controls and employee devices are compromised.

Why AI Changes the Security Equation

The incidents illustrate two sides of an emerging threat: AI can help attackers gain access to systems, while organisations increasingly rely on the same technology to detect and prevent attacks. Binance's report notes that the exchange has expanded its AI-based anomaly detection.

IBM's 2026 Cost of a Data Breach Report found that one in four malicious breaches involved AI, a 56% increase from the previous year. Most of these incidents involved deepfake impersonation and AI-enabled malware rather than fully autonomous agents.

That distinction matters. The immediate threat is not necessarily an AI system independently deciding to hack an organisation; it is the ability of attackers to use AI to make existing techniques faster, more convincing and easier to scale. Fraudulent messages, impersonation, malware and social engineering all become more effective when AI is used to generate convincing communications or automate parts of an operation.

For cryptocurrency companies, where employees may have access to valuable assets and sensitive infrastructure, a single compromised account or device can carry significant consequences.

The threat is also becoming harder to contain. In June, Immunefi chief executive Mitchell Amador warned that the cryptocurrency industry could have three to four years before defenders develop capabilities comparable to those of emerging AI threats. Circle chief executive Jeremy Allaire has similarly argued, in an interview shared on X by Brian Sozzi, that organisations should operate on the assumption that they are under attack.

Nigeria's financial sector may already be experiencing the effects. Prembly chief executive Lanre Ogungbe reportedly told Bloomberg that AI-driven attacks on the country's financial sector increased by 150 per cent.

For Nigerian users, the risks extend beyond cryptocurrency exchanges to bank accounts, digital payment platforms and personal information. AI-assisted impersonation and phishing could make it harder for customers to distinguish legitimate communications from fraudulent ones.

Nigeria Has Plans, but No AI-Specific Law

Nigeria has begun developing a legal framework for AI, but the process has yet to produce a standalone AI law.

The National Digital Economy and E-Governance Bill is one of the main legislative vehicles for addressing the issue. Senate ICT committee chairman Shuaib Salisu has indicated that the legislation will cover AI agents. The bill has been promised repeatedly since late 2025, and the Senate now targets passage before the end of the year. Until it is passed and signed into law, however, it cannot function as an enacted regulatory framework. For Nigeria's cryptocurrency and digital finance businesses, that timeline matters: the bill's final text will shape what security and accountability obligations apply when AI tools can reach sensitive internal systems.

Other initiatives are progressing separately. The Nigeria Data Protection Commission (NDPC) is reviewing the Nigeria Data Protection Act to address emerging AI-related concerns. The National Information Technology Development Agency (NITDA) is working with government institutions on possible changes to Nigeria's cybersecurity framework, and its director-general, Kashifu Inuwa, has described a joint review of cybercrime legislation with the Office of the National Security Adviser and the National Assembly.

The government's efforts suggest that AI regulation is no longer being ignored. The challenge lies in turning these separate initiatives into enforceable legislation.

When AI-Assisted Attacks Reach Nigerian Users

Nigeria already has laws that may apply to some AI-assisted attacks, including the Cybercrimes Act and the Nigeria Data Protection Act. The absence of a standalone AI law does not mean that attackers or organisations are operating entirely outside existing legal protections.

However, the growing use of AI raises pressing questions about whether existing legislation adequately addresses the responsibilities of companies deploying AI systems: Who is responsible when an AI agent accesses sensitive information without authorisation? What security obligations should organisations meet before deploying AI tools that can access internal systems? How should regulators investigate incidents involving AI agents, and what remedies should affected users receive?

These questions grow more urgent as companies integrate AI into customer services, software development, financial operations and internal workflows.

Voices outside government have pressed for firmer rules. X user @Wealth_ese1 noted that NITDA has published an AI roadmap, but argued that "a roadmap isn't law." Cybersecurity expert Peter Obadare told Vanguard that "regulation is not excessive, it is necessary."

The concerns extend beyond finance. The Independent National Electoral Commission (INEC) has issued a clarification over allegations involving AI-generated photographs in its preliminary voter register, underscoring the potential implications of AI for public trust and election administration.

The Question Is Accountability

The Chainalysis breach, the Binance theft and Nigeria's unfinished AI legislation point to a growing challenge: AI is becoming part of both the tools organisations use and the methods attackers exploit.

The incidents do not establish that AI caused the Binance theft, nor do they prove that existing Nigerian laws are incapable of addressing every AI-assisted attack. But they demonstrate why the responsibilities of organisations deploying AI need to be clearly defined.

Nigeria's proposed legislation could provide a framework for addressing those responsibilities, but its effectiveness will depend on what it requires, how it is enforced and whether regulators have the capacity to respond to rapidly evolving threats.

For a country with significant cryptocurrency adoption and a growing digital financial sector, the question is no longer whether AI will affect cybersecurity. It is whether Nigeria's legal framework will be ready when the next attack happens.

Source: TechNext24