Binance let Claude Code trade and the safety model is a subaccount

Jagmeet Singh's TechCrunch piece on 20 August 2026 is the press version. ChatGPT, Codex, Claude Code, and Cursor can read markets, peek at the book, and send trades. Jeff Li, Binance's VP of product, called the control an account-level sandbox.

Withdrawals blocked by default sounds like a lock. It is a lock on the door that leaves the exchange. Inside the room the agent can still spend the furniture.

Treat the Agentic sub-account like a prepaid card. Not like linking a bank. That is the whole post.

The install is a trading grant#

The official path is one line in Claude Code. claude mcp add binance-mcp-server --transport http https://agent.binance.com/mcp/agentic.

Binance's MCP docs print that command, then send you through OAuth. No API key on the laptop. A hosted MCP on agent.binance.com.

That is not a research plugin. The Trade scope covers spot, margin, convert, USD-M futures, and COIN-M futures.

The scopes you actually grant are a short catalog, not a mystery.

• Market data is public and needs no auth
• Account reads Agentic balances, and can optionally see the main book read-only
• Trade covers spot, margin, convert, and both futures products
• Transfer moves coins between wallets inside the same sub-account only

The missing chip is the one that matters. There is no withdrawal scope. The docs say it twice, never available, the agent cannot send coins to an external address.

You'll add this the way you add every other remote MCP. One command, a browser bounce, a scope list.

The difference is the next tool call can be Buy $100 of BNB at market on spot. That sentence is in the docs as the first-session example. It is not a metaphor.

A withdrawal block is not a max-loss#

The steelman is real. Isolated funds, a human-only first deposit, and an emergency stop that disconnects every agent and cancels spot, margin, and futures in one click.

Li told TechCrunch they put the control at the account level to protect user funds. Subaccounts you can point at spot or futures. Withdrawals blocked by default.

That is a sandbox if the threat is an agent wiring USDT to a burner. It is not a sandbox if the threat is the agent trading until the box is empty.

TechCrunch asked the loss question. Binance does not impose a separate cap on how much an AI agent can trade or lose. The amount transferred into the sub-account is the limit.

Official docs never name a max-loss, a max-notional, or an insurance figure for MCP trades. They recommend funding the box with only what you will let the agent trade. That sentence is the product.

The sub-account starts empty. The agent cannot pull from main. You transfer it yourself under Profile, Dashboard, Sub-account, Asset Management.

The type shows up as Agentic virtual sub. Pretty name. Still a balance.

Then the interior door. Transfer scope is not withdrawal. It is Spot to USD-M inside the same envelope.

Trade then covers both futures products. Liquidation does not need an external address. It zeros the prepaid card from the inside.

Emergency stop is a panic button after the fills. Disconnect agents, cancel positions, take the leftover home through Asset Management.

Useful. Not a loss cap. You will hit this after a session you should have sized smaller.

A locked front door and an open kitchen is still a house. Do not fund it like a checking account because the thief cannot reach the street.

Binance sees the fill, not the prompt#

Li said the quiet part. "We really cannot see the reasoning of what the user's action is."

The loop runs on your machine or inside the app you picked. Binance sees the order. It does not see the webpage that poisoned the context, the skill that hallucinated a ticker, or the Always Allow you clicked because the dialog looked like ls.

Prompt injection blast radius is the funded envelope. Same shape as agents that request every OAuth scope they might need. The catalog here is smaller.

Market data, Account, Trade, Transfer. Trade still covers the book you actually care about. A thinner catalog is not a smaller loss.

The MCP docs currently pause on every write. The agent restates symbol, side, type, amount, and waits for yes. That is confirm-first.

A Binance representative told TechCrunch you can also let it run once permissions are set. Treat the docs as the default. Treat autonomy as an interview line.

Either way the envelope does the math.

Confirm-first is also how JFrog Boost almost granted rm rf. A bored yes on a familiar dialog. Pair that with Claude Code auto mode and the pause is a speed bump, not a wall.

One more leak. Account scope can still see the main book, read-only. Isolation is for spending, not for curiosity.

An injected session can study the real portfolio, then spend only the prepaid card. That is still a tell.

The other books already sold this permission#

Binance is late to letting the coding agent hit a CEX, not unique. The permission boxes already exist. They just live in different rooms.

• Kraken starts on paper, and live trade is a Dangerous flag
• Coinbase offered a sandbox or the main account
• Binance funds a live Agentic sub-account and deletes withdrawal from the catalog

Kraken's MCP docs default to market, account, and paper. Live trade is marked Dangerous. Dangerous tools want acknowledged: true unless you pass --allow-dangerous.

Pass -s all and funding can initiate withdrawals. Kraken's sandbox is paper. Binance's sandbox is a live empty box you fund.

Coinbase for Agents, in TechCrunch's June writeup, offered the main account or a separate sandbox. Custom limits such as max trade size were still "soon" in that piece.

Different envelope, same question. Do you hand the agent the whole wallet, or a slice.

OKX's Agent Trade Kit FAQ is the honest version. AI-generated actions can trigger real trades and significant losses. Strip withdrawal off the key unless you mean it.

Test with small amounts before scaling. Binance deleted withdrawal from the vocabulary and left the transfer as the budget. Same job, cleaner box.

Do not mix this with Agentic Wallet. That on-chain surface does carry Binance-set daily limits. Alexis asked Binance on X for the swap, DeFi, and x402 numbers, which is the right question pointed at the wrong surface.

TechCrunch, citing the company, put regular swaps at $50,000 a day, DeFi at a $100,000 default, and x402 payments at $20. Those numbers are a wallet quota. They are not a max-loss on the MCP trade path Claude Code just joined.

Fund the Agentic sub-account like a prepaid card. If a published per-agent max-loss shows up that is not the sub-account balance, the title is stale. Until then, the cap is the transfer you already made.