Beyond the Bank
 |
Welcome back to Beyond the Bank |
Major U.S. banks say AI agents are already operating inside customer accounts, and they can't always tell whether the customer sent them. Morgan Stanley is blocking outside agents, while JPMorgan, Bank of America and Citi are restricting them, according to a report from Axios.
This week: the record $6.3 billion Binance hack, the agent identity problem banks are trying to solve, HSBC's warning on deposit competition, and an update on South Korea's AI-assisted bank hacks. |
Trivia Question❓Which Philadelphia bank, chartered by the Continental Congress in 1781, is generally considered the first commercial bank in the United States? Answer at the bottom of the newsletter |
 |
Binance, the world's largest crypto exchange, says about $6.3 billion was pulled from its wallets in roughly 20 minutes on Thursday, October 29, the largest crypto theft on record.
What happened: An attacker moved funds out of Binance wallets across ten blockchains, including Ethereum, Bitcoin, Tron and Solana. TRM Labs reported that it is about four times the size of the $1.5 billion Bybit hack in February 2025. Binance paused withdrawals while it checks its systems, and says deposits are still working normally.
Who pays: Binance says it will cover all losses and has reserved more than $6.34 billion of company funds to do it, ABC News (Australia) reported. Co-CEO Richard Teng said the breach hit Binance's own hot wallet, the internet-connected wallet used to process transfers, and that customer assets are held under a separate security system, Yahoo Finance reported.
What got frozen: Binance says about $3 billion has been frozen. Chainalysis puts it near $2.8 billion. Stablecoin issuers were able to freeze funds quickly, but bitcoin and ether can't be frozen that way, which is why the attacker raced to convert stablecoins.
Who did it: Chainalysis and TRM both attribute the hack to TraderTraitor, a North Korea-linked hacking group. Chainalysis calls its strongest evidence the way the stolen funds mixed on-chain with money taken in last month's Bitget theft, which was also tied to North Korea. That attribution comes from analytics firms. Binance says it is working with law enforcement to confirm who was behind it, Al Jazeera reported. Binance first pointed to a compromised engineer's laptop, then said its investigation found more points of breach, Cointelegraph reported.
What's next: As of Saturday, Binance said it aimed to restart withdrawals in stages by Sunday and publish a full proof-of-reserves report by Monday, November 2. Check Binance's own status updates for where that stands.
Why it matters: crypto kept on an exchange is not covered by FDIC deposit insurance. In a hack like this, the exchange's own reserves and its promise to pay are what stand behind your balance. Binance says it can cover this loss, but that is a statement about Binance, not about every platform. It is also a reminder for anyone using crypto rails: keep on an exchange only what you actively need there. |
| ||||||||||||||||||
 |
💷 HSBC's shares fell 7% on a deposit warning. On October 27, HSBC reported $11.7 billion of banking net interest income for the third quarter, below the $11.9 billion analysts expected, and flagged tougher competition for deposits, Reuters Breakingviews reported. The column's takeaway: banks may not gain much from further rate hikes, and the sector's returns may have peaked.
🇰🇷 South Korea's five biggest bank CEOs apologized to lawmakers. At an October 19 National Assembly audit, the heads of KB Kookmin, Shinhan, Hana, Woori and NH NongHyup answered for a string of AI-assisted cyberattacks. Shinhan reported about 25,000 customers' data exposed, and lawmakers noted it took the bank 15 hours and 26 minutes to detect the intrusion, The Elec reported. The financial regulator's chief warned that CEOs could be held accountable. For how the attack worked and what it means for your own accounts, see our earlier look at the Korean bank hacks.
🔒 A crypto lending protocol hit pause after the Binance hack. Aave froze its markets as a precaution after the Binance exploiter borrowed $44.6 million there. The protocol says new deposits and borrowing have since resumed, Cointelegraph reported. A small example of how one breach ripples through connected platforms.
💳 Lloyds and Visa settled $750,000 with a stablecoin in under an hour. In a seven-day pilot that included a weekend, funds reached Visa in the U.S. in less than 60 minutes, East & Partners reported on October 15. Ordinary bank settlement usually waits for business hours. |
 |
A correct password no longer proves a person is the one on the other end.
On October 22, Axios reported, citing people familiar with the matter, that several large U.S. banks are finding third-party AI agents working inside customer accounts. Morgan Stanley has begun blocking outside agents. JPMorgan, Bank of America and Citi are restricting them rather than banning them outright, The Tech Portal reported. Wells Fargo is among the banks named as detecting them.
The problem: banks say they can't reliably tell whether an agent is following the customer's instructions, has been compromised, or is an unauthorized actor, TechNewsWorld reported. Even a legitimate, logged-in agent might misread an instruction or send the wrong payment. Some agents have reportedly taken steps nobody asked for, such as calling customer service lines on their own, Technology.org reported.
The other side: a Morgan Stanley spokesperson said the bank has not observed rogue agents on its platforms and is blocking them as a precaution. A Chase spokesperson told customers not to give their username and password to anyone.
Where it's heading: most banks have allowed, or are moving toward, read-only access, which lets an agent see account information but not move money or change details, similar to what banks already give apps like Quicken. Several banks are also updating their terms of service to address agents, Gizmodo reported.
Why it matters: if you use an AI helper with your money, handing it your login can break your bank's rules and leave you holding the risk. Last week we covered JPMorgan's and Schwab's moves. This week's reporting shows the problem is wider than two banks. |
 |
 Photo by Jonas Leupe on Unsplash |
The plumbing that moves money between banks is being rebuilt, and this week brought fresh numbers.
Visa: On its October 27 earnings call, Visa said its stablecoin settlement has passed an annualized pace of $25 billion, about ten times a year ago, across 10 blockchains, FinanceFeeds reported. Settlement is how banks and payment firms square up with each other behind the scenes, and stablecoins let that happen on weekends and holidays. Keep it in proportion: a run rate is a pace, not a total, and FinanceFeeds notes Visa settled almost $13 trillion between institutions over the prior year, mostly in regular dollars.
SoFi: On October 22, SoFi launched SoFi Earn, which Fortune describes as the first consumer tokenized deposit from a national bank. A tokenized deposit is an ordinary bank deposit recorded as a token on a blockchain, so it stays inside the banking system. Fortune says holders get FDIC protection, with a catch: the tokens only move between people who bank with the same issuer.
The big banks: JPMorgan, Bank of America, Citi and Wells Fargo are building a shared tokenized deposit network run by The Clearing House, targeted for the first half of 2027, Forbes reported. That network is meant to fix the catch above.
Why it matters: two kinds of digital dollar are now competing for the same jobs, and they come with different protections. Our Deep Dive below explains the difference and what to ask before you use either. |
| ||||||||||||||||||
 |
 Photo by K on Pexels |
Two official reports show where U.S. banking stands as November begins.
The Fed: On October 28, the Federal Open Market Committee kept its target range for the federal funds rate at 3.75% to 4.00% on a 10-2 vote. The two dissenters, Lisa Cook and Beth Hammack, wanted a quarter-point increase, according to the Fed's statement. In his press conference, Chair Kevin Warsh said financial and credit conditions have tightened for some businesses and households since September's hike, though he would not call them tight overall. The meeting minutes are due November 18.
The FDIC's latest bank scorecard: The second-quarter Quarterly Banking Profile, released August 25, covers 4,238 insured institutions:
Read it with care: the FDIC's own statement attributes part of the profit jump to trading revenue during market volatility and one-time gains on equity securities, and it notes that unrealized losses on securities remained elevated.
Why it matters: banks are healthy and lending, but the Fed's open question is whether to raise rates again, not cut them, so borrowing costs may stay high for now. The FDIC's third-quarter profile is due in late November. |
 |
The tool: any mainstream AI chat assistant. The job: turning a long terms-of-service page into a plain-English answer to one question: what happens to my money if something goes wrong?
Why now: this week's Binance hack is a reminder that where your money sits matters. The FDIC says its insurance only covers deposits at insured banks and only when the bank fails, and its fact sheet says it does not protect against theft or fraud, or against the failure of a non-bank company such as a crypto exchange or wallet provider.
How to do it:
Mind the limits: an AI summary is a reading aid, not legal advice, and it can't tell you whether a company is financially sound. If the answers are vague, treat that as an answer. |
 |
Both are called "digital dollars," and both move on a blockchain. Only one of them is a bank deposit. With Visa, SoFi and the biggest U.S. banks all making moves this month, here is what separates them and why it matters for your money.
What a stablecoin is. A stablecoin is a token designed to always be worth one dollar. It is issued by a company and sits outside the banking system. Fortune explains that this means a stablecoin cannot earn interest or carry FDIC backing. Under the OCC's proposed rules for the GENIUS Act, issuers must hold one dollar of safe assets for every coin and cannot pay holders interest. The OCC finalized its rules on October 21, and they take effect January 18, 2027.
What a tokenized deposit is. It is a regular bank deposit, recorded as a token. Wells Fargo, announcing its version on August 4, called it a blockchain-based representation of commercial bank money that stays inside the regulated, insured banking system, with the same protections and deposit insurance eligibility as its other deposits. The GENIUS Act expressly leaves tokenized deposits out of its definition of a payment stablecoin, so a bank needs no stablecoin license to offer one, Tech Times reported.
The trade-off. Stablecoins can go to anyone with a crypto wallet. Tokenized deposits generally work only between customers of the same bank, because a token from one bank is a claim on that bank. That is the problem the big banks want to solve. JPMorgan, Bank of America, Citi and Wells Fargo are building a shared network through The Clearing House, targeted for the first half of 2027, and Forbes reported that JPMorgan's in-house platform already averages more than $7 billion a day.
What "FDIC-insured" does and does not mean. Even for a true bank deposit, FDIC insurance has limits. It pays up to at least $250,000 per depositor, per insured bank, when that bank fails. The agency's fact sheet says it does not cover crypto assets, theft or fraud, or the failure of a non-bank company. That is the gap the Binance hack exposed: Binance has promised to cover users from its own reserves, but a company's promise is not deposit insurance.
Four questions to ask before using either one:
Why it matters: the pipes are converging, but the protections are not. Two things that look identical on a phone screen can sit on very different legal footing. What to watch: the OCC rules take effect January 18, 2027, and the banks' shared network is due in the first half of 2027. |
LAST WEEK ON BEYOND THE BANK |
Missed these? Start with last Monday's issue on why JPMorgan and Schwab are blocking outside AI agents, then read how credit unions and banks really differ and the Fed's proposed rules for bank-issued stablecoins. |
 |
Bank blockchain projects are moving from pilots to real use, at least for big business customers.
On October 13, Citi CEO Jane Fraser said its tokenized deposit service now runs in seven markets, PYMNTS reported. Wells Fargo said it launched its own version in September, and BNY settled a tokenized Treasury note in minutes instead of a day.
Why it matters: banks want deposits to move at any hour so money doesn't drift to stablecoins. A tokenized deposit is still a bank deposit; a stablecoin is not, and isn't FDIC-insured.
Your move: nothing changes today. When someone offers you "digital dollars," ask whether it's a deposit or a stablecoin. Read More... |
The fintech app on your phone may be about to become an actual bank.
More than 30 neobanks, lenders, payment companies and digital-asset firms have gone through the U.S. bank charter process in 2026, according to an American Banker tracker updated October 2. Only two have been granted full charters. Most hold conditional approvals or are still waiting.
The biggest name is Revolut, which announced conditional OCC approval on September 3. It still needs the FDIC and the Federal Reserve before it can open. Nubank, Mercury, Upstart and Mission Lane also won conditional approvals this year. Bunq was denied.
A charter lets a fintech hold deposits directly and skip the partner-bank middle layer. That layer failed badly in 2024, when the Synapse bankruptcy left many app customers cut off from their money for months. The trade-off is full bank regulation, and a conditional approval is not an open bank.
Why it matters: The line between bank and banking app is blurring, which could mean more competition and fewer fragile middle layers.
Not sure whether your app is a bank? Check its fine print for the partner bank's name, then look it up in the FDIC's BankFind tool. Read More... |
Canada's six largest banks, BMO, CIBC, National Bank, RBC, Scotiabank and TD, are jointly exploring a shared network for tokenized Canadian-dollar deposits, BNN Bloomberg reported on September 22.
A tokenized deposit is an ordinary bank deposit recorded on a blockchain-style ledger. It's still a claim on a regulated bank, unlike a stablecoin, but it can settle in seconds, run 24/7 and carry programmable conditions. The first phase would move these deposits between institutions. No launch date has been set, and one expert called it "really exploratory."
Canada's bank regulator, OSFI, said in September that tokenized deposits are legally the same as traditional ones, as reported by The Block.
In the U.S., JPMorgan, Bank of America, Citigroup and Wells Fargo are building a similar network through The Clearing House, targeting the first half of 2027, Forbes reported.
Why it matters: Banks are rebuilding their payment plumbing to keep deposits from drifting to stablecoins. Businesses should see it first, in payments that settle on weekends. Consumers will feel it later, mostly behind the scenes.
Open questions remain, including how deposit insurance applies to tokenized balances. Read More... |
A cloned voice of a family member, a fake call from your bank, a deepfake video pitch: AI has made old scams far more convincing.
The FBI's 2025 Internet Crime Report logged 22,364 complaints involving AI and nearly $893 million in reported losses. Overall, the FBI said Americans reported nearly $21 billion in losses last year, and people over 60 lost $7.7 billion, up 37%.
AI's real danger is that it removes the tells we rely on. So the best defenses don't depend on spotting the fake.
The five habits: set a family safe word, as the FBI recommends. Hang up and call back on a number you already trust. Treat urgency as the red flag. Limit public audio and video of yourself. And refuse requests to pay strangers by gift card, wire, crypto or payment app.
One free tool most people already have: real-time transaction alerts in your bank or card app, which can give you time to stop a transfer.
Why it matters: As fakes get better, process beats instinct. If you're hit, call your bank right away and report it at ic3.gov. Read More... |
JOKE OF THE WEEK |
My bank says it can't tell whether the AI logging into my account is really me.
Fair. Some mornings I can't tell either. |
 |
Know someone who should be reading this? Forward this email, or send them to beyondthebank.capital to subscribe free. New issue every Monday.
Missed an issue? Read the latest issue online or browse past issues.
Questions, tips or story ideas? Email us at contact@beyondthebank.capital.
Beyond the Bank is for informational purposes only and is not financial, legal, or investment advice. |
💡 Answer to Trivia Question: The Bank of North America. Congress chartered it at the urging of financier Robert Morris to help fund the Revolutionary War, and it opened for business in January 1782. |