Hackers now deploy AI against crypto firms: Why is Nigeria’s AI law still missing?

A breach at blockchain intelligence firm Chainalysis and a multibillion-dollar theft involving Binance have exposed how artificial intelligence is becoming part of the cyberattack landscape. As attackers turn AI tools against major crypto companies, Nigeria is still missing a legal framework to govern the technology.

The incidents raise questions about whether the country’s existing cybersecurity and data protection laws are sufficient to address attacks involving increasingly autonomous AI systems.

Nigeria ranked second globally in cryptocurrency adoption in Chainalysis’ 2024 Global Crypto Adoption Index, making the security of digital financial services particularly relevant to the country.

What has been confirmed, and what has not

Chainalysis, the blockchain intelligence firm that helps cryptocurrency exchanges, governments and law enforcement trace stolen digital assets, disclosed last week that an attacker had used what it described as “offensive agentic techniques” to access its systems and internal tools.

The company confirmed that the intruder accessed user IDs, full names, email addresses, and organisational role labels for some users of its platform. It reported finding no evidence that the attacker accessed investigation content, transaction or query results, passwords in clear text, multifactor authentication secrets or user session tokens.

Chainalysis has not explained exactly how the attacker used AI, which vulnerabilities were exploited, or how much of the intrusion was automated. In a later update, it disclosed that it had temporarily taken some products, like Reactor and Data Solutions, offline while conducting additional security assessments.

Credit: Bloomberg

The Binance incident is separate.

The cryptocurrency exchange reported that approximately $6.34 billion in digital assets were affected by a security incident last week. In its initial findings published this week, the exchange reported freezing or intercepting about $2.85 billion in assets and promised to absorb the financial impact of the theft.

Citing information from the FBI, Binance attributed the attack to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis linked it to a group known as TraderTraitor.

The report describes a multi-stage attack involving fake recruitment interviews, malicious software, compromised employee devices and stolen credentials. It also discloses that an attacker used a compromised engineer’s computer and an internal AI tool to gain control of two other engineers’ machines before accessing infrastructure connected to its wallet operations.

This does not establish that AI independently carried out the theft. Rather, it shows how an AI-enabled internal tool can become part of an attack chain when access controls and employee devices are compromised.

Also read: North Korean-linked hackers steal $6.3 billion from Binance in biggest crypto heist ever

Why AI changes the security equation

The incidents illustrate two sides of the emerging threat. AI can help attackers gain access to systems, while organisations are increasingly relying on the same technology to detect and prevent attacks. The exchange’s report notes that it has expanded its AI-based anomaly detection.

IBM’s 2026 Cost of a Data Breach Report found that one in four malicious breaches involved AI, representing a 56% increase from the previous year. Most of these incidents involved deepfake impersonation and AI-enabled malware rather than fully autonomous agents.

This distinction matters because the immediate threat is not necessarily an AI system independently deciding to hack an organisation. It is the ability of attackers to use AI to make existing techniques faster, more convincing and easier to scale.

Fraudulent messages, impersonation, malware and social engineering can become more effective when attackers use AI to generate convincing communications or automate parts of their operations. For cryptocurrency companies, where employees may have access to valuable assets and sensitive infrastructure, a compromised account or device can have significant consequences.

The threat is also becoming harder to contain. In June, Immunefi chief executive Mitchell Amador warned that the cryptocurrency industry could have three to four years before defenders develop capabilities comparable to those of emerging AI threats.

Circle chief executive Jeremy Allaire has also argued, in an interview shared on X by Brian Sozzi, that organisations should operate on the assumption that they are under attack.

Nigeria’s financial sector may already be experiencing the outcomes. Prembly chief executive Lanre Ogungbe reportedly told Bloomberg that AI-driven attacks on the country’s financial sector increased by 150 per cent.

For Nigerian users, the risks extend beyond cryptocurrency exchanges to bank accounts, digital payment platforms and personal information. AI-assisted impersonation and phishing could make it harder for customers to distinguish legitimate communications from fraudulent ones.

Nigeria has plans, but not an AI-specific law

Nigeria has begun developing a legal framework for AI, but the process has yet to produce a standalone AI law.

The National Digital Economy and E-Governance Bill is one of the main legislative vehicles for addressing the issue. Senate ICT committee chairman Shuaib Salisu has indicated that the legislation will cover AI agents. The bill has been promised repeatedly since late 2025, and the Senate now targets passage before the end of the year.

Until it is passed and signed into law, however, it cannot serve as an enacted regulatory framework.

NITDA Director General, Kashifu Inuwa Abdullahi

Other initiatives are progressing separately. The Nigeria Data Protection Commission (NDPC) is reviewing the Nigeria Data Protection Act to address emerging AI-related concerns.

The National Information Technology Development Agency (NITDA) is also working with government institutions on possible changes to Nigeria’s cybersecurity framework. Its director-general, Kashifu Inuwa, has described a joint review of cybercrime legislation with the Office of the National Security Adviser and the National Assembly.

The government’s efforts suggest that AI regulation is no longer being ignored. The challenge is turning these separate initiatives into enforceable legislation.

Also read: Nigerians can learn free AI and digital skills offline through Skilling Africa with Google

What happens when AI-assisted attacks reach Nigerian users?

Nigeria already has laws that may apply to some AI-assisted attacks, including the Cybercrimes Act and the Nigeria Data Protection Act. The absence of a standalone AI law does not mean that attackers or organisations are operating entirely outside existing legal protections.

However, the growing use of AI raises questions about whether existing legislation adequately addresses the responsibilities of companies deploying AI systems.

Who is responsible when an AI agent accesses sensitive information without authorisation?

What security obligations should organisations have before deploying AI tools that can access internal systems?

How should regulators investigate incidents involving AI agents, and what remedies should affected users receive?

These questions become more important as companies integrate AI into customer services, software development, financial operations and internal workflows.

Voices outside government have pressed for firmer rules. X user @Wealth_ese1 noted that NITDA has published an AI roadmap, but argued that “a roadmap isn’t law.” Cybersecurity expert Peter Obadare told Vanguard that “regulation is not excessive, it is necessary.”

The concerns extend beyond finance. The Independent National Electoral Commission (INEC) has also issued a clarification over allegations involving AI-generated photographs in its preliminary voter register, highlighting the potential implications of AI for public trust and election administration.

The question is accountability

The Chainalysis breach, the Binance theft and Nigeria’s unfinished AI legislation point to a growing challenge: AI is becoming part of both the tools organisations use and the methods attackers exploit.

The incidents do not establish that AI caused the Binance theft, nor do they prove that existing Nigerian laws are incapable of addressing every AI-assisted attack. But they demonstrate why the responsibilities of organisations deploying AI need to be clearly defined.

Nigeria’s proposed legislation could provide a framework for addressing those responsibilities, but its effectiveness will depend on what it requires, how it is enforced and whether regulators have the capacity to respond to rapidly evolving threats.

For a country with significant cryptocurrency adoption and a growing digital financial sector, the question is no longer whether AI will affect cybersecurity. It is whether Nigeria’s legal framework will be ready when the next attack happens.