Binance heist is stark example of AI governance gaps and basic security failures

Publisher excerpt From CSO Online

A chain of avoidable technical and human security failures enabled the largest crypto heist on record, the theft of approximately $6.34 billion from Binance. The improper monitoring and access scoping of an internal AI tool played a major role in helping the hackers, and should serve as a warning for enterprise CISOs to take AI governance seriously. Binance’s initial findings report, published Nov. 3, describes a months-long, multi-stage campaign against its wallet-infrastructure engineers that resulted in malware being installed on developer machines in two separate incidents, only one of which was detected. The attackers were then able to pivot through an internal AI tool to additional developer systems, obtain an access token, and deploy a container on Binance’s infrastructure before executing the rogue withdrawals. While Binance describes this attack as highly sophisticated, there were multiple security failures involved that could have been avoided, from weak or absent access controls to overly broad privileges, poor credential hygiene, and employee security awareness lapses or policy violations. “Developer workstations have quietly become some of the most privileged assets in the enterprise, carrying deployment tokens, signing access, and now AI tools that can act across internal systems on an employee’s behalf,” warns Joe Brinkley, director of offensive security research and community at security firm Cobalt. “Once an attacker controls that machine, an AI tool with broad internal reach becomes one more trusted path they can use.” He adds: “Security teams should treat engineers with production or signing access as a high-value attack surface, test the path from workstation to production the way an adversary would, and scope AI tool permissions as tightly as any service account.” Two compromises, months apart The FBI has attributed the Binance breach to North Korea, identifying the hacking unit as TraderTraitor, which other researchers consider part of the broader Lazarus operation that has stolen billions of dollars from cryptocurrency platforms over the past decade. Binance’s own report relays the FBI’s conclusion and notes that throughout 2026, the company’s security team detected and prevented 57 suspected North Korea–linked cyber threat cases. This suggests Binance has the Lazarus APT in its threat model, as it should, and is well aware of the group’s tools, techniques, and procedures (TTPs), which include software supply-chain compromises, the use of malware that masquerades as popular legitimate tools, tricking developers with fake job interviews, and long-horizon social engineering operations. Yet, two Binance engineers fell victim to exactly these tricks, raising questions about the company’s security awareness training as well as its technical controls. In June, a wallet-infrastructure engineer searched the web for a popular AI coding tool and downloaded a tampered Homebrew installer rather than obtaining the software from…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.