Binance $6.34 Billion Stolen: How Did Hackers Leverage Internal AI Tools to Carry Out the Infiltration?

Author: Mehab Qureshi (TheStreet)

Translated by TechFlow

TechFlow Brief: In the historic $6.34 billion crypto asset theft disclosed by Binance, an alarming security vulnerability has come to light: after bypassing peripheral employee terminals through a fake job interview, attackers directly leveraged an internally deployed AI tool at Binance to cross isolation barriers and reach the core wallet team. Walton Comer, co-founder of enterprise AI security defense firm Mace AI, pointed out that the hacked computer itself did not hold core keys, but it had access permissions to call internal AI, which possessed advanced system privileges even exceeding those of the human engineers who used it. This incident demonstrates that enterprise autonomous agents lacking rigorous adversarial testing are highly susceptible to becoming hidden backdoors for attackers lurking deep within the intranet.

The full article is as follows:

Binance has officially confirmed that the hackers behind the largest recorded crypto asset theft directly exploited an internal AI tool belonging to the exchange to expand the scope of their attack.

In an exclusive interview with TheStreet Roundtable, Mace AI co-founder Walton Comer provided an in-depth analysis of the security lapse. He stated that the AI tool running on the compromised corporate laptop possessed system access privileges that even exceeded those of the human engineer using the device.

Mace AI positions itself as an intelligent agent security assurance company focused on enterprise-grade AI. The firm tests AI models and agents from a hacker's perspective, specifically seeking cognitive vulnerabilities and patching them before real-world attackers can exploit them.

Its flagship product, Fisher, conducts adversarial red team testing on AI agents utilizing various tools, subsequently providing enterprises with concrete risk evidence alongside specific guidelines and steps to remediate the discovered vulnerabilities.

Binance's Official Investigation Report on the Attack Incident

The preliminary findings report released by Binance on November 3 indicates that the total impact of digital assets affected by this incident amounts to approximately $6.34 billion. As of now, roughly $2.85 billion in compromised assets have been successfully frozen or intercepted.

The report reveals a months-long campaign. The attack began as early as June with the download of a tampered malicious software, followed by a fraudulent job interview targeting a Binance engineer in September.

The situation escalated further on October 20, when attackers leveraged the compromised engineer's computer and an internal AI tool to successfully penetrate and reach the workstations of two additional engineers from the wallet infrastructure team.

On October 29, the attackers deployed a container using stolen system credentials and triggered unauthorized withdrawal operations against Binance's hot wallets. Hot wallets refer to online wallets connected to the internet, used by exchanges to process daily transaction transfers.

Binance stated in the report that the FBI has explicitly attributed responsibility for the attack to a North Korean hacking group. The FBI itself confirmed this conclusion in a public notice released on October 31.

How an Internal AI Tool Became a Foothold for Attackers

Mace AI, co-founded by Comer, specializes in testing enterprise AI agents for security vulnerabilities. With a career spanning Wall Street, Comer began his journey at a firm under hedge fund giant Steve Cohen before later engaging in deep collaborations with institutional partners in the high-risk digital asset sector.

Previously, he appeared on TheStreet Roundtable alongside co-founder Greg Frank to discuss the real-world implications for businesses of the OpenAI Hugging Face data breach.

He noted that this attack chain followed a classic pattern well-known in the cybersecurity industry, but introduced a brand-new step unprecedented in its execution.

He praised Binance's candor in publicly disclosing its investigation results: "They demonstrate true industry leadership on this point." However, he emphasized that beyond what the exchange has already revealed, "we currently do not possess any other exact details."

His assessment on how the security breach further spread was highly incisive: "I would be extremely shocked if the compromised computer itself held administrative keys for any systems. My intuition tells me it was just a fairly typical engineer workstation."

He explained that a standard laptop like this typically only stores access credentials for specific systems or code commit permissions, and would absolutely never directly store core wallet keys.

However, "it had access to the internal AI. Unfortunately, this AI possessed higher-level system privileges that Binance itself was unaware of."

"Once the hackers successfully gained entry to that computer, they were able to interact with the AI assistant also deployed on it. It was precisely this AI that assisted them in gaining further access to other devices within Binance's internal infrastructure."

"If they couldn't leverage that AI tool, the attack would likely have ended right there on that single laptop... Ideally, the defense framework should have completely stopped it at that point."

Comer stated that Binance becoming a target is hardly surprising. "For adversaries, Binance is one of the juiciest and most valuable targets in the world, essentially their number one prey."

He added, "In terms of cybersecurity, Binance is undoubtedly one of the most technically mature institutions with top-tier defensive capabilities in the industry; their security practices rank among the highest globally." Therefore, penetrating their intranet "involves extremely convoluted steps... far from easy. This was an extremely complex, precision attack."

No Intelligent Agent Should Possess Operational Privileges Exceeding Its User's

In Comer's view, the core countermeasure to mitigate this risk is a non-negotiable rule: "No intelligent agent should have the capability to perform actions that the person interacting with it does not already have authorization to execute."

He pointed out that there are many ways to trigger an AI to violate safety alignment and act beyond its authority, "one obvious method being simply 'politely making a request'."

Even well-constructed security guardrails often fail easily. "This is almost always the reality: existing guardrails are nowhere near as effective as people assume. The only viable way to uncover these vulnerabilities is through continuous stress testing."

Why Pre-incident Testing and Post-incident Monitoring Are Equally Crucial

"If you rely solely on post-incident monitoring, you will often only detect anomalies after an incident has occurred... whereas if you prioritize pre-incident testing, you can pinpoint exactly where vulnerabilities lie in advance. Companies need both, and coverage must be comprehensive across both intranet and extranet environments."

Binance's investigation report indicates that the exchange has thoroughly restructured the involved internal AI tool and its access controls, replaced the associated hardware, invalidated compromised legacy credentials, and hired independent third-party security agencies for further audits.

"If you carefully examine Binance's post-incident reports and official announcements, you will see they are fully implementing both measures. This is entirely the correct course of action."

He emphasized, "Every company worldwide deploying agentic tool chains must begin adopting identical defensive strategies, and they must approach this with extreme rigor. I consider this a timely wake-up call."

Put simply, Agentic Tool Chains refer to AI agents that are deeply integrated into core enterprise systems, thereby enabling them to autonomously execute various specific operations.

Comer issued a stark warning that Binance's security breach is by no means the end of such incidents. "The cybersecurity landscape was already quite severe in October," he described the security climate of that period using the commonly cited term 'Black October', "November could prove even worse, and more troublingly, the defensive posture in December may become even more arduous."

Why He Is Not Concerned About Bitcoin's Own Security

Comer explicitly distinguished the centralized security of exchange systems from Bitcoin itself. "I believe Bitcoin itself will absolutely not face severe AI-related threats in the same way centralized systems do."

He stated that Bitcoin's underlying code has long undergone highly stringent scrutiny from numerous top-tier AI models, including closed-source models from Anthropic and OpenAI that have yet to be publicly released. "To date, no fatal vulnerabilities capable of fundamentally undermining network security have been uncovered."

He pointed out that compared to AI, Bitcoin's deeper long-term potential risk actually stems from quantum computing. "The true risk stems more from advances in cryptography and quantum computing rather than AI itself." He added that both Bitcoin and Ethereum have already established evolution and upgrade adaptation plans for scenarios where quantum attacks become a reality.

Concluding the interview, he left readers with a thought-provoking warning: "In the very near future, we will almost certainly engage in further discussions surrounding the next major security headline of a similar nature."