Binance lost $6.3 billion, and a music registry kept its records.

On October 29, attackers moved roughly $6.3 billion in cryptocurrency out of Binance in about 20 minutes, across ten blockchains. TRM Labs ranks it as the largest cryptocurrency theft on record. Investigators believe the attackers compromised the infrastructure that authorizes transactions, and some transfers carried pre-signed authorizations that were technically valid. The blockchains recorded every transfer correctly. The world’s most sophisticated trading venue had built a system that could prove, with mathematical certainty, that its funds had been stolen.

The flaw is old.

A record can be authentic even when the act it records is unauthorized. A valid signature remains valid even after the machine that produced it falls into the wrong hands, and an immutable ledger records a fraudulent transfer as carefully as an honest one. Cryptography secured the record and left the question of authority unanswered.

The industry that was supposed to be behind

For decades, the music industry has been the standard example of a sector that technology left behind, with fragmented metadata, disputed credits, incomplete ownership records, and multiple versions of the same recording. One part of it now has a safeguard that Binance lacked when it mattered.

ProofProfile holds 2,006,172 artists and 9,900,355 recordings. Each recording has a CopyrightChains registration and a confirmed Bitcoin timestamp via OpenTimestamps. On 9 August 2026, we anchored a closure manifest for the entire corpus to Bitcoin.

The underlying data comes from MusicBrainz and AcousticBrainz datasets dating from before 2022, when generative AI music did not exist.

The method is simple.

Each record is reduced to a hash, which is committed to Bitcoin. The proof lets anyone confirm that the record existed in that exact form at that block. ABBA’s Dancing Queen, ISRC SEAYD7601020, was confirmed in block 953513 on 13 June 2026, and anyone can verify it at verify.proofprofile.net. No one can alter that record to match its proof, including the company that runs the registry. A stolen key changes nothing, because the proof was never stored behind a key.

The proof’s limits are part of why it holds up. It does not establish who wrote Dancing Queen, who owns it today, or who may license it. A 2026 timestamp does not prove a recording existed in 2008.

The pre-2022 source datasets document the earlier history, and the timestamp prevents anyone from rewriting it afterward. Binance’s records also made no false claims.

They simply had no way to distinguish a valid instruction from an authorized one.

Why this reaches beyond music

Music has its own version of the Binance problem. In October, Michael Smith was sentenced to 18 months in prison for an AI-assisted scheme that combined hundreds of thousands of generated recordings with billions of fake streams to collect more than $8 million in royalties, all of it processed by platforms as legitimate activity. IFPI’s Streaming Integrity Initiative and the US Copyright Office’s inquiry into streaming fraud, opened on 7 October, both ask whether money should move because a system accepted an instruction or only after the evidence behind it has been checked.

That question matters more as AI agents start licensing, negotiating, and paying on their own. An agent cannot tell a convincing claim from a true one by reading it more carefully. It can check whether a record existed independently before anyone had a reason to change it, at almost no cost and without trusting whoever supplied the record.

A crypto exchange with every advanced defense available was compromised by instructions that looked legitimate. A music registry built from twenty-year-old metadata and a timestamp protocol that anyone can run has records that cannot be backdated by an attacker, a rival claimant, or its own operator.