CryptoSlate
Hackers used a compromised employee computer and Binance’s internal AI tool to compromise two wallet engineers before stealing $6.34 billion in cryptocurrency, the exchange disclosed. Attackers later obtained a container deployment permission token and used it to reach wallet-signing operations, initiating unauthorized transactions across several blockchains.
Binance said the intrusion unfolded over months. One engineer downloaded a tampered installer for an AI coding tool in June; another was targeted in September through a fake recruitment process and malicious coding assignment. The FBI attributed the broader attack to North Korea. Binance said its investigation does not show that an AI model autonomously planned or carried out the theft.
Why it matters
The breach puts developer devices, credentials and AI-enabled tools in the path to sensitive systems. Researchers have warned that attackers are using AI for reconnaissance and social engineering, and are increasingly attempting to automate parts of intrusions or manipulate coding assistants and security scanners.
Binance said it has rebuilt the affected AI tool and wallet infrastructure, replaced compromised devices and strengthened access controls. It is also seeking partnerships with AI firms, blockchain participants and cybersecurity companies, and has commissioned an independent security review. Details of the proposed security fund and partnerships remain undisclosed.
Market impact
Binance said $2.85 billion of the $6.34 billion in affected assets had been frozen or intercepted, and 98% of impacted token assets had been replenished as of Oct. 31. The scale of the incident puts the exchange’s security controls and recovery measures under scrutiny.
The independent review is expected to assess weaknesses and inform further safeguards. Its findings, alongside the scope of Binance’s planned AI-security investment, will shape how the exchange responds to the breach.
Frequently asked questions
-
How did attackers reach Binance’s wallet-signing operations?
They used a compromised employee computer and internal AI tool to compromise two wallet engineers, then obtained a container deployment permission token that helped them reach wallet-signing operations.
-
Did Binance say an AI model autonomously carried out the theft?
No. Binance said its investigation does not establish that an AI model autonomously planned or executed the theft. The attack also involved compromised devices, credentials and social engineering.
-
What role did the compromised developer devices play?
One engineer downloaded a tampered installer for an AI coding tool, while another was targeted through a fake recruitment process and malicious coding assignment. The compromised devices helped attackers move deeper into Binance’s systems.
-
How much of the affected cryptocurrency did Binance say was recovered or replenished?
Binance said $2.85 billion of the $6.34 billion in affected assets had been frozen or intercepted. It also said 98% of impacted token assets had been replenished as of Oct. 31.
-
What security measures is Binance taking after the breach?
Binance said it rebuilt the affected AI tool and wallet infrastructure, replaced compromised employee devices and strengthened access controls. It also commissioned an independent cybersecurity review and is seeking industry security partnerships.
TheBlock
WuBlockchain
CoinDesk