Binance Gives AI Agents Direct Control of Crypto Trading Infrastructure

Third-party artificial intelligence models can now directly execute cryptocurrency trades and manage financial accounts on Binance, as the exchange with over 300 million registered users shifts live trading capabilities to autonomous software.

The new infrastructure, named Agent OS, allows software developers to link AI tools directly to Binance’s financial core. It integrates existing services including Binance APIs, the Binance Wallet Agentic Hub, the Binance x402 transaction verification and payment facilitator API, and the Binance Skill Hub, alongside newly added support for its Model Context Protocol (MCP). The system connects with external AI tools like OpenAI’s ChatGPT and Codex, Anthropic’s Claude Code, and Cursor, permitting designated agents to inspect market data, review account status, and place trades without human intervention.

Binance’s Agent OS lets agents trade on users’ behalfImage Credits:Binance

As the broader technology industry transitions from conversational chatbots to autonomous agents that act independently, Binance is placing the burden of oversight directly on account owners, who must configure permission levels, trading limits, and operational scopes for their automated software.

“Instead of total freedom, we put the power in users’ hands to give them the granular access control of what they can do through the agent,” said Jeff Li, vice president of product at Binance, in an interview. “We put [the control] at the account level to protect the users’ funds.”

Binance implements this isolation primarily through dedicated “sub-accounts”, which customers assign to individual agents with specific parameters for spot or futures markets. Off-platform fund withdrawals from these sub-accounts are locked by default, Li told TechCrunch, effectively creating a contained testing environment for each agent’s operations.

Account holders can determine whether an agent requires human sign-off for each transaction or operates with full autonomy once permissions are established, according to a Binance representative. Because Binance sets no independent restriction on trading volume or loss ceilings for AI tools, the funds allocated to a sub-account effectively serve as the limit.

Binance’s sub-accounts can have specific transaction limits and permissionsImage Credits:Binance

Addressing whether Binance can inspect the decision-making logic behind an agent’s market orders, Li stated that the underlying reasoning occurs entirely outside the exchange’s server infrastructure, executing on local user machines or third-party AI services. “We really cannot see the reasoning of what the user’s action is,” he said.

Consequently, while Binance can track the final market transactions triggered by an agent, the exchange lacks visibility into whether those trades stemmed from erroneous dataset inputs or deliberate external manipulation.

When asked about potential vulnerabilities such as prompt-injection exploits or compromised agent code, Li reiterated that sub-account isolation remains the primary safeguard. Binance added that its standard API security rules, risk-control protocols, and anti-money-laundering checks apply to all Agent OS connections at launch.

Prompt-injection attacks occur when hidden text or untrusted data trick an AI model into overriding its developer instructions, creating specialized financial risks when software handles live trading keys. In automated trading environments, an agent exposed to manipulated market commentary or malicious web content could execute unauthorized trades or liquidate positions before traditional anti-fraud systems respond.

While active trading marks the initial focus, Li noted that software agents can perform broader tasks, including continuous market surveillance, risk assessment, automated research, signal detection, and programmatic arbitrage execution.

Beyond centralized exchange functions, Agent OS connects automated agents directly to blockchain payment channels and decentralized protocols. Through the integrated x402 feature, agents can execute payment settlements, while the Agentic Wallet enables automated interaction with digital tokens and decentralized-finance protocols.

In contrast to centralized order book trading—where sub-account balances define the loss ceiling—Binance enforces hard daily spending limits for Agentic Wallet activity. The company caps standard token swaps at $50,000 daily, limits decentralized-finance interactions to a default $100,000 per day, and restricts x402 payments to $20 a day, according to the company.

Li characterized Agent OS as Binance’s “first step” toward giving developers a platform to build AI-powered applications that can act across crypto and traditional markets.

The launch aligns Binance with a broader industry push among major cryptocurrency exchanges to grant software agents direct access to trading venues and market feeds via standardized frameworks like MCP.

Exchange integration of autonomous agents has accelerated rapidly throughout the industry, beginning when Kraken released an open-source command-line tool with an embedded MCP server in March, followed by Coinbase launching Coinbase for Agents in June with account-level controls, and OKX enabling agentic trading on its platform by bringing an open-source MCP toolkit earlier this year.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.