Binance loses $6.34 billion to AI tool and engineer compromise

Binance disclosed that hackers stole $6.34 billion in cryptocurrency by exploiting the exchange’s internal artificial intelligence tools and compromising employee systems. The theft was detailed in a security report released on Nov. 3, which outlined the specific mechanisms used by the attackers to gain unauthorized access to the platform’s core infrastructure.

Attack Methodology

According to the security report, the breach occurred on Oct. 20. Attackers utilized a compromised employee computer as an entry point into Binance’s internal network. Once inside, they leveraged an internal AI tool to escalate their access and take control of two engineers. These engineers were specifically responsible for Binance’s wallet infrastructure, giving the attackers direct influence over the systems managing user assets.

The report highlights that the compromise of these two specific roles was critical to the execution of the theft. By controlling the engineers responsible for wallet infrastructure, the attackers were able to bypass standard security protocols and initiate the transfer of funds. The use of an internal AI tool in this process indicates that the attackers did not simply break into the system from the outside but manipulated existing internal resources to facilitate the breach.

AI in Security and Fraud

Binance had previously relied on artificial intelligence to fight fraud and enhance its security posture. The incident reveals that while AI tools are effective for detecting external threats, they can also be repurposed by attackers if internal access is compromised. The exchange’s reliance on AI for fraud prevention meant that the very tools designed to protect the platform were used against it during the Oct. 20 incident.

The security report does not specify the exact nature of the AI tool’s function in the attack, only that it was an internal asset exploited by the hackers. The compromise of the employee computer suggests a failure in endpoint security or credential management, allowing the attackers to pivot from a single compromised device to critical infrastructure roles.

The total amount stolen was reported as $6.34 billion in cryptocurrency. This figure represents a significant loss for the exchange and underscores the risks associated with centralized custody of digital assets. The incident has drawn attention to the potential vulnerabilities in systems that integrate AI into core operational and security functions.