Binance relied on AI to fight fraud before hackers exploited internal tool in $6 billion theft - CryptoSlate

According to the security report, attackers used a compromised employee computer and an internal AI tool on Oct. 20 to take control of two engineers responsible for Binance's wallet infrastructure. The attackers subsequently obtained access to a container deployment permission token, which helped them penetrate the exchange's wallet-signing operations on Oct. 29 and initiate unauthorized transactions across several blockchain networks.

The disclosure puts AI at the center of one of the largest cryptocurrency thefts on record, adding to concerns about how increasingly connected AI systems can introduce new vulnerabilities into corporate infrastructure. Binance's investigation does not establish that an AI model autonomously planned or executed the theft.

Rather, the attackers exploited an internal AI tool as part of a broader campaign involving stolen credentials, compromised developer software, and social engineering. The FBI has attributed the broader attack to North Korea, whose hacking operations have increasingly targeted software developers and cryptocurrency businesses.

Attackers exploited AI vulnerabilities

In June, a Binance engineer downloaded a tampered software installer while attempting to install a popular AI coding tool. Binance detected the suspicious activity, replaced the device and rotated associated credentials, although information about the employee and colleagues had already been exposed.

In September, another engineer fell victim to a fake recruitment operation involving staged job interviews and a malicious coding assignment. The malware compromised the employee's computer and gave the attackers access, which they later used to move deeper into Binance's systems.

The attackers exploited an internal AI tool as part of a broader campaign involving stolen credentials, compromised developer software, and social engineering.

AI becomes a growing weapon

The Binance incident follows months of warnings from cybersecurity researchers that artificial intelligence is expanding both hackers' capabilities and the systems available for exploitation. In February, Google's Mandiant reported that North Korean hackers targeting the cryptocurrency industry had incorporated AI-assisted techniques into their operations.

By September, Google's Threat Intelligence Group reported that attackers were moving beyond using AI to generate malicious content toward automated operations that could execute multiple stages of an intrusion. In one case, hackers compromised a cloud resource and organized an AI-assisted mass credential-harvesting campaign in less than six hours.

Binance seeks AI security solutions

The exchange is now seeking support from the same industry whose technologies were featured in the attack. Binance said it is working to establish a security research fund and develop targeted initiatives with leading AI companies, blockchain industry participants and cybersecurity firms.

The proposed collaboration will focus on strengthening AI security in blockchain environments. Binance has also commissioned an independent cybersecurity review to validate its investigation and identify additional safeguards. The company said approximately $2.85 billion of the $6.34 billion in affected digital assets has been frozen or intercepted, while 98% of impacted token assets had been replenished as of Oct. 31.

The independent review has yet to establish the full extent of the weaknesses that allowed attackers to exploit the exchange's internal AI environment. Its findings will inform the security changes Binance plans to implement as it develops the proposed industry fund.