AI Helped Enable the Biggest Crypto Hack: Binance Explains What Happened

Hackers used an internal AI tool to push deeper into crypto exchange Binance, according to the company. The attack resulted in the theft of around $6.3 billion in cryptocurrency. Fake job applications and malware were also part of the operation.

The FBI attributes the October 29 theft to North Korea. The agency calls the activity TraderTraitor.

In its preliminary investigation report, Binance explains how attackers used an internal AI tool on October 20 to take over two other work computers. They found a token that allowed software containers to be deployed, then used stolen credentials to carry out the final heist.

An access token is a digital credential. Software uses it to perform an authorized action, such as installing a program on a server. A container is a package that runs software together with the components it needs.

As early as June, an employee downloaded a tampered version of the Homebrew installer while trying to install an AI coding tool. Binance replaced the computer and access credentials, but information about the employees involved had already been exposed.

The report does not identify the AI tool or its provider, nor does it explain how the tool was exploited. It also does not prove that AI carried out the attack autonomously.

In other attacks, too, interest in AI has been used as bait. Cisco Talos previously uncovered malicious installers masquerading as AI software. AI Wereld reported on how such fake websites for popular AI tools spread malware. That research is unrelated to the Binance attack.

Another entry point came through what appeared to be a routine job application. As Bloomberg reports, someone contacted a Binance engineer on a job-seeking platform and posed as a project director. The engineer then chatted with the supposed executive of a fictional company through a messaging app.

The engineer was then given an assignment that required downloading a collection of code. It contained malware—software that could give the attacker unauthorized access. A process that appeared designed to assess the engineer’s skills thus delivered malicious code.

Microsoft investigated similar fake job applications in its report on Contagious Interview. That report describes separate attacks. Fake recruiters send developers coding assignments through familiar platforms such as GitHub, GitLab and Bitbucket. Running a package can silently install a backdoor.

Development environment settings can also play a role. Microsoft found cases where trusting an unfamiliar project in Visual Studio Code automatically triggered a predefined task, which then downloaded malicious software.

The damage may extend beyond the infected computer. Microsoft found that these attacks searched for cloud access, access tokens, cryptographic keys and password files, among other things. A developer’s computer could therefore provide access to the employer’s systems. The key question is what corporate permissions an infected device can still use.

A familiar code platform’s name says little about the safety of an individual project. Checks should focus on who sent it, what it contains and what happens when it is opened or run. For a job applicant, these are separate questions: a convincing interview does not answer any of the technical questions about the code attached to it.

North Korean groups are not only exploiting internal tools; they are also using AI to speed up their own operations. That is according to research published by Microsoft on October 29. The company describes AI assistance with target research, convincing identities, translations, recruiter messages and malicious coding assignments.

One example is Jade Sleet. In a single week, the group used three fictional companies to approach potential victims. One posed as a provider of AI for blockchain analysis. Microsoft sees the pace and scale as signs that generative AI accelerated the preparation and outreach.

AI can help tailor messages to a particular role or industry and keep a fabricated identity consistent. Microsoft stresses that the operations it examined are still directed by people. The report does not link these examples to the Binance heist.

Google previously reported that North Korean attackers had misused Gemini for research and deceptive messaging. AI Wereld then covered Gemini’s role in such cyber campaigns. Google also spotted deepfake images in a separate operation that lured victims into downloading a malicious Zoom app.

That changes what applicants can judge at a glance. Well-written messages, a polished profile and convincing visuals are reasons to look more closely—not proof that an employer is legitimate or that its coding task is safe.

For organizations connecting AI to business systems, the key question is how much access it gets. Security organization OWASP warns against giving AI tools too many capabilities, permissions or too much autonomy. The risk arises, for example, when a tool meant to read documents can also modify or delete files.

What matters is what the application is allowed to do. An AI tool that reviews code doesn’t also need the ability to deploy new software to production servers. And a tool that retrieves information for one employee doesn’t automatically need access to every colleague’s data.

OWASP recommends enforcing these limits in the underlying systems. Simply telling a model to be careful is not access control. The system that stores the data or carries out an action must itself verify that the specific operation is authorized.

These are general security principles. Without more technical details, it is not possible to determine which access controls, if any, failed at Binance.

Microsoft advises developers to run interview assignments in a separate, isolated environment—with no company accounts, internal code or access to production systems. Have any supplied code reviewed before installing components or running tasks. If a device may be infected, security teams should isolate it and replace any credentials that may have been exposed.

For AI agents that actually perform tasks, OWASP goes further in its guidance on secure AI integrations. Give each agent its own account with limited permissions, so its access can be monitored and revoked independently. Use temporary access tokens that are valid only for the task at hand.

Keep sensitive credentials out of the agent’s working environment. Require human review for high-impact actions such as deploying software, deleting data or changing permissions. Store activity logs somewhere the agent cannot control, so investigators can later establish what happened.

The execution environment needs clear limits too: use a sandbox with restricted access to files and the network. If an unfamiliar task runs malicious code, those safeguards limit the company resources it can reach. Configure the environment to match what the agent actually needs.

Binance says it has rebuilt the affected AI tool and its access controls. In an earlier incident update, the company pledged to cover the financial losses from the stolen crypto assets itself. An independent review has yet to verify the preliminary findings of the investigation.