TRM Labs: KYC for AI Agents Must Start With the Human Behind Them

North Korean hackers stole around $6.3 billion from Binance last week after tricking employees through a fake job interview. They even exploited an internal AI tool. Most of the money was gone within 20 minutes.

The Binance hack exposed how quickly criminals can move billions. Meanwhile, as AI agents begin making payments themselves, financial institutions face another question: who is responsible when software controls the money?

At Merge Madrid, TRM Labs executive Guillaume Rodenas offered a surprisingly simple answer.

“I think as long as you can actually verify the principal, so essentially the one who controls the agent who has the mandate, I think you’re probably in a good position.”

Essentially, verify the person or company controlling the AI agent. Its transaction history can then help establish what it did on their behalf.

But Who Pays When AI Makes a Mistake?

“That’s obviously kind of the million-dollar question, right?” Rodenas admitted.

He suggested developers could bear responsibility for software bugs. Users also need to understand the financial protocols they use.

Decentralized autonomous organizations (DAOs) make accountability even harder. Rodenas linked this uncertainty to why Europe’s MiCA regulations have largely excluded fully decentralized finance.

Meanwhile, criminals are already moving faster than traditional security teams.

TRM Labs estimates that North Korea accounted for 85% of the value stolen in crypto hacks this year. Total losses reached a record $8.7 billion, largely driven by Binance.

Are Century-Old Banks Ready for On-Chain Risk? 

Rodenas said criminals increasingly deploy autonomous agents to interact with protocols and initiate transactions around the clock. AI has also appeared in attacks on traditional banks.

“So if the crime happens twenty-four-seven, the defenders have to work twenty-four-seven too.”

TRM already uses AI to continuously monitor wallets and detect suspicious activity. Yet Rodenas sees a different challenge among European banks: their willingness to adapt.

“There are some differences in readiness, but there’s mostly differences in willingness.”

Some banks have dedicated blockchain teams. Others still have employees struggling to convince management that digital assets matter.

Rodenas believes the distinction between crypto and traditional money will eventually disappear.

“I think in a few years from now we’ll probably just stop calling it crypto, digital assets or whatever the case may be. It will be just a new form of asset, and we’ll just call it money, right?”

For banks, that future presents an immediate challenge: preparing for a financial system where software can move money without waiting for human instructions.