Why artificial intelligence raises today’s risks, quantum computing changes tomorrow’s cryptography, and retailers must rebuild trust around people and systems.
The most revealing detail in the latest multibillion-dollar cryptocurrency theft was not a revolutionary cryptographic attack. According to Binance’s preliminary investigation, attackers cultivated relationships with software engineers, staged job interviews, persuaded an employee to download a malicious assignment and then exploited access to internal systems. The case should concern every retailer operating stores, payment services, loyalty platforms or increasingly autonomous AI systems. The technologies will become more sophisticated, but the first opening may still be an entirely ordinary act of human trust.
I learned that lesson long before generative AI became a boardroom priority. For years I was active in the cryptocurrency community under the name Professor Keeting, teaching several thousand students about cryptocurrencies, NFTs and Web3.
Much of our discussion eventually returned to security: ownership of a private key meant little if someone could be convinced to hand it over, sign the wrong transaction or trust the wrong person.
In the retail industry, where I have spent more than two decades working on technology and compliance, the scale and operational consequences are different, but the fundamental vulnerability is familiar.
The Binance warning is about access, not just assets
Binance reported that approximately $6.34 billion in digital assets were affected by its October 29, 2026 security incident, while stressing that its investigation remained preliminary and subject to independent review. Its account describes more than one entry point: a compromised software download in June that exposed information about wallet engineers, fraudulent recruitment contacts in September, and malicious code presented as an interview assignment. Investigators also reported that attackers used a compromised internal AI tool as a stepping stone before reaching wallet-signing operations. These are Binance’s disclosed findings, not a final independent forensic conclusion.
This is an important distinction for business leaders.
The attackers did not need to defeat cryptography by brute force or deploy a quantum computer. They reportedly used believable context, patience and legitimate-looking workflow to get closer to people with privileged access. The victim was not necessarily careless; a professional interview process and developer tooling are ordinary parts of working life. Effective defense therefore cannot depend on employees identifying every deception. It must assume that a convincing deception will occasionally succeed and limit what that success can unlock.
Retail has already paid the price
Retail cyber incidents are not confined to stolen payment-card records. In 2025, Marks & Spencer suspended online orders after a major cyber incident while dealing with inventory disruption, manual processes, additional logistics and waste costs. Its initial public estimate was an approximately £300 million impact on 2025/26 group operating profit before mitigation, insurance and other actions; its subsequent 2026 full-year reporting documented £131.3 million of incident-related costs and £100 million of insurance proceeds, figures that must not be mistaken for the original estimate or simply added together.
The Co-op provides a second, different illustration. The group reported an estimated £285 million direct impact on 2025 revenue and an estimated £107 million impact on profitability associated with its cyber attack and protective system restrictions. These are company estimates rather than a universal price tag for a breach, but they show how an interruption can travel from IT into availability, customer visits and the economics of convenience retail.
In a modern retailer, a cyber incident can disconnect far more than an e-commerce website. Stores depend on POS systems, inventory visibility, warehouse scheduling, promotion engines, supplier interfaces and payment services; a failure in one part can force expensive manual work in another. International retailers add country-specific fiscal devices, digital signatures, reporting gateways and regulated transaction records. Security is therefore part of operational continuity and legal compliance, not a separate technical function measured only by the number of blocked attacks.
AI changes the economics of deception
AI gives attackers more than fluent phishing emails. It can help collect public information about employees and suppliers, tailor messages to a known project, imitate voices or appearance, generate convincing documents and speed the discovery of weak configurations. The UK National Cyber Security Centre’s November 2026 assessment characterizes AI primarily as an accelerator of existing methods, improving the speed, scale and efficiency of reconnaissance, social engineering, vulnerability discovery and exploit development, rather than automatically inventing entirely new categories of attack. That sober framing is more useful than declaring that every future intrusion will be autonomous.
Consider a retailer preparing to open stores in a new country. A finance employee may receive a plausible request from an apparent implementation partner to update bank details; a store manager may receive an urgent voice message ostensibly from regional management; an IT engineer may be asked to install a seemingly necessary connector for a fiscal device. Generative AI can make these approaches more personalized and easier to repeat across languages and markets. Those are illustrative scenarios, not claims about the causes of the cited retail incidents.
The same transformation is occurring inside legitimate systems. Retailers want AI assistants to reconcile invoices, prepare reports, update catalogues, support customer service and eventually execute actions. An assistant that can read policies is very different from an agent that can alter supplier bank details, approve refunds, issue payment instructions or change POS configurations. Once software moves from answering to acting, access scope, authorization, audit trails and the ability to stop an agent become core business controls. An agent should not inherit every permission of the employee who asks it to work.
Quantum is a separate clock, and retailers should start it now
Quantum computing deserves attention, but with precision. There is no basis to claim that current quantum computers can routinely break the encryption protecting retailer networks or payment systems today. The strategic risk is that sufficiently capable future fault-tolerant quantum computers could undermine widely deployed public-key algorithms used for key exchange and digital signatures. Symmetric encryption and hashing face different, generally less dramatic implications, so a claim that quantum will simply break all encryption is misleading.
In August 2024, the US National Institute of Standards and Technology approved its first three post-quantum cryptography standards, FIPS 203, 204 and 205, covering key establishment and digital signatures. The UK NCSC recommends discovery and initial planning by 2028, early priority migrations by 2031 and broad completion by 2035. These are planning milestones, not predictions that a cryptographically relevant quantum computer will arrive in 2035.
Retailers should care because cryptography is embedded in long-lived systems whose replacement cycles are measured in years. A retailer may depend on hardware security modules, payment terminal software, POS-to-cloud connections, device certificates, software-update signatures, supplier APIs and local fiscal signing components. An international chain also needs to know which cryptographic decisions sit with its payment providers, cloud providers, POS vendors, fiscal middleware suppliers and government-facing interfaces. No single retailer can migrate that ecosystem alone, which makes supplier questionnaires and contract renewal cycles practical places to begin.
There is also a “harvest now, decrypt later” concern: an adversary can capture certain encrypted communications today in the hope of reading them with future quantum capabilities, making long-lived confidential data a priority for protection. Retailers need to distinguish that confidentiality exposure from digital signatures that protect integrity and authentication, and they should assess retention periods, business sensitivity and supplier dependencies before rushing into a wholesale technology replacement.
The answer is not another awareness poster
The most productive security investments make successful deception less consequential. Phishing-resistant multifactor authentication, tightly scoped privileged access, separate administrator accounts, short-lived credentials, secure software-supply-chain controls and independent approval for sensitive changes should form the operating baseline. CISA recommends phishing-resistant MFA, especially for privileged users and accounts with access to financial or customer data; it also identifies hardware-backed FIDO authentication and passkeys as stronger alternatives to easily phished codes.
For retailers, controls must be designed around the physical business. A change to supplier banking details should require verification through a trusted, previously established channel. A temporary store support account should not permit a bulk export of loyalty data. A compromised service provider should not automatically obtain access to every store in the estate. A local POS outage needs a tested fallback process that preserves transaction integrity and meets applicable fiscal requirements rather than an improvisation made during a crisis.
AI creates a further requirement for explicit operating boundaries. Retail leaders should maintain a register of agents, record each agent’s owner and permissions, log the actions it takes, test how it responds to malicious instructions in external documents, and require meaningful human approval for irreversible or high-value transactions. Retailers should also prevent confidential company information from being quietly copied into unapproved AI tools. An agent’s output can be persuasive without being authorized, and a complete audit trail is valuable only when someone is accountable for reviewing exceptions.
The quantum workstream should begin with a cryptographic inventory rather than a purchase order. Teams need to identify where public-key algorithms are used, which certificates and devices are difficult to replace, what information must remain confidential for a decade or longer, and which suppliers can demonstrate credible post-quantum migration plans. Procurement should require cryptographic agility so algorithms and keys can be changed without replacing an entire retail platform. This is a practical engineering program, not a marketing badge.
Trust has to be engineered
My years teaching crypto taught me that security failures rarely fit the simple story of a foolish user clicking an obvious link. They usually develop inside systems of incentives, habits and apparently legitimate interactions. AI will make the deception more convincing and more scalable, while future quantum capabilities will require substantial changes to the cryptographic foundations on which digital commerce depends. The two developments operate on different timelines, but together they make the cost of postponing security decisions harder to defend.
The human remains a frequent entry point, although it would be wrong to say that human error is the sole or inevitable cause of every breach. Attackers also exploit vulnerabilities, architecture and supply chains. The appropriate conclusion is not to blame employees, but to design organizations where an employee can be deceived without handing over the keys to the entire business. Retailers who combine that principle with controlled AI autonomy, tested operational resilience and an orderly post-quantum transition will be better prepared for a future in which trust itself becomes the most valuable technology.
Sources and further reading
[1] Binance, “29 October 2026 Binance Security Incident: Initial Findings and Response Update,” 3 Nov 2026. https://www.binance.com/en/blog/community/3229153443759566763
[2] Fortune, “North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack,” 3 Nov 2026. https://fortune.com/2026/11/03/binance-hack-details-linkedin/
[3] Marks & Spencer, “Full Year Results for the 52 Weeks Ended 29 March 2025,” 21 May 2025. https://corporate.marksandspencer.com/newsroom/press-releases/full-year-results-52-weeks-ended-29-march-2025
[4] Marks & Spencer, “Full Year Results for the 52 Weeks Ended 28 March 2026.” https://corporate.marksandspencer.com/newsroom/press-releases/full-year-results-52-weeks-ended-28-march-2026
[5] Co-op, “Co-op navigates headwinds and looks forward with confidence, clarity and purpose,” 2026. https://www.co-operative.coop/media/news-releases/co-op-navigates-headwinds-and-looks-forward-with-confidence-clarity-and
[6] UK National Cyber Security Centre, “NCSC Annual Review 2026: The impact of AI on cyber threat,” 3 Nov 2026. https://www.ncsc.gov.uk/collection/annual-review-2026/understanding-threat/ai-impact-cyber-threat
[7] NIST, “Announcing Approval of Three Federal Information Processing Standards for Post-Quantum Cryptography,” 13 Aug 2024. https://www.nist.gov/news-events/news/2024/08/announcing-approval-three-federal-information-processing-standards-fips
[8] UK NCSC, “Timelines for migration to post-quantum cryptography,” 20 Mar 2025. https://www.ncsc.gov.uk/guidance/pqc-migration-timelines
[9] CISA, “Phishing Guidance: Stopping the Attack Cycle at Phase One,” 2025. https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf
[10] CISA, “Mobile Communications Best Practice,” 2024. https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf
