How North Korean hackers turned Binance's own internal AI into a weapon in $6.3b heist - interview

Two weeks after a massive $6.3 billion cyberattack on cryptocurrency exchange Binance, internal investigations revealed the key role of Binance's own AI tools in the heist. According to cyber expert Ori Segal, the attack utilized one of Binance's internal AI models to compromise two engineers' computers, marking the first large-scale incident where a company's AI tools were weaponized by hackers.

Segal, CEO of Cybore, explained that the attack also involved a poisoned package manager, a fake recruiter, a malicious file, credential reuse, and an overly broad deployment permission, yet none of these steps required AI. While most cybersecurity experts have focused on AI's potential in recent years, this incident highlights the need to also address the risks associated with the AI tools companies use internally.

Segal emphasized that companies currently lack clear guidance on how to prevent these attacks and recommended stopping the pressure for results, checking whether tasks need to be performed on specific devices, and avoiding the use of unvetted third-party code on work computers. Additionally, he pointed out that the job interview lure used to target the engineers is itself a significant vulnerability, as it puts employees in a position where revealing they are job hunting could lead to punishment for reporting the attack.