Cybersecurity Lessons from Binance: The Impact of AI and Insider Threats

In June, according to early reporting, someone at Binance downloaded what looked like an installer for an AI coding assistant. It wasn't.

In September, a different engineer at the same company was reportedly approached about a new job. There was a recruiter, a video interview with "HR" and a take-home coding test. The test appears to have carried malicious code.

In late October, the attackers are understood to have used that engineer's laptop, and one of Binance's own internal AI tools, to reach colleagues on the wallet team. Then, on 29 October, roughly US$6.3bn left Binance's hot wallets in around twenty minutes. If the figures hold, it is the largest crypto theft on record. The FBI has attributed it to a North Korea-linked group, which Pyongyang denies.

The detail is still coming out and some of it will change. What already looks clear is that nobody appears to have broken Binance's cryptography. They got inside, stayed quiet for months, and waited for the right moment.

That was five days before our webinar on 3 November, and it ended up framing most of what we talked about.

I was joined again by the panel from our September breakfast. Will Morrish from CovertSwarm breaks into organisations for a living, with permission. Duncan Bates from Fortinet builds the technology meant to stop him. And Richard Morrison-Butcher, a detective chief inspector with City of London Police, sees what happens when nobody does.

Will opened with a line I've already stolen twice this week:

 "Everybody wants a security onion. Most companies, in reality, have got more of a security egg. It might be a reasonably solid shell, but it's pretty soft and gooey inside."

His point was that most organisations have spent years, and most of their budget, on the perimeter. Firewalls, email filtering, VPNs. All useful. But once someone is through, there's often very little stopping them going wherever they like.

He gave us two examples that have stayed with me.

The first was a large finance firm with a big batch-processing system at the heart of its network. Well run, well secured, many layers deep. Will's team simulated a bribed insider plugging in a USB stick. That system could still talk to the internet, so they set up command and control over ping. Yes, ping. You can carry a payload out in an ICMP packet and get a different one back. If you think ping is harmless, it's worth another look.

The lesson for me: treat your outbound traffic as seriously as your inbound. Most people don't.

The second was a retailer whose new starter, on his third day, clicked a convincing "you've been set up on this platform" email. He realised something was off within a minute and reported it. The security team followed their ISO 27001 process exactly. User terminated, password changed. But nobody killed the active VPN session, so Will's team stayed in for another two days.

The process was compliant and it was followed properly. It still had a gap, because nobody had rehearsed it against an attacker who was already inside.

Then Will told the story that I think the room will remember longest. 

A large finance company's CISO told CovertSwarm they'd never get in. So the team spent a couple of weeks arguing with one of the firm's customer service agents about an exchange rate, playing the part of an irritated customer, until the agent was frustrated enough to say "can you just send me a screenshot?"

They sent a PDF with a payload in it. The endpoint protection raised a warning, but by then the agent trusted them. Then the team did nothing for three weeks.

The SOC looked at the alert, saw no follow-up activity in the hours afterwards, and moved on. Three weeks later the payload was triggered, and the team ended up with the customer service estate and the CRM.

 "Go slow," Will said. "You don't always need to go fast."

Duncan made the same point from the defender's side. He's seeing two kinds of attack: very fast ones, and very slow ones where the attacker gets in and waits for the logs to roll over. A human analyst working through a busy alert queue struggles with both.

Put that next to Binance. If the reporting is right, that was around five months from first foothold to theft, and the theft itself took minutes.

This is where the "agentic" part of the webinar title comes in.

Duncan described it simply. When a person hits a block screen, that's usually the end of it. They might try their phone's hotspot, but mostly they give up and ring IT to ask why they can't get to something.

An AI agent doesn't do that. If it hits a block, it looks for another way round: different DNS, a different gateway, routes injected into the network stack, even data parked somewhere on the internet for another agent to pick up. Duncan called it non-human logic, and our firewall policies were never written for it. Most were built around predictable people doing predictable jobs.

So the shift has to be from rules to behaviour. Rather than asking "is this allowed?", we need to ask "is this normal?" That means visibility first, then control, then automation fast enough to act at machine speed. It also means zero trust checks that keep running for the whole session. A VPN that was fine on Monday shouldn't be trusted until Wednesday.

Binance also shows the other side of this. AI tools are increasingly the way in, as well as the thing doing the attacking. Early reporting suggests both an AI coding assistant and an internal AI tool played a part. Neither of those is exotic. They're the kind of tools most organisations are rolling out right now, often with the same access as the person using them.

We ran a couple of polls during the webinar. Around 60% of attendees told us they’re now using AI across the business, but only 17% said they have full visibility of the AI tools in use across their organisation. That’s up from zero in September, but adoption is still running far ahead of visibility. And as Binance showed, the AI tool nobody is watching can be the way in. 

Richard brought the numbers that make this real for anyone running a UK business.

Fraud and cyber now make up 46% of all recorded crime in England and Wales. Policing puts around 2% of its resources into it. Over the past year, there's been a rise of nearly 400% in victims reporting that AI was used in the reconnaissance or social engineering against them.

His view is that AI is industrialising crime. It lowers the barrier to entry so far that an organised group no longer needs a skilled hacker, just someone willing to point a tool at a target.

"Policing can't arrest its way out of this problem," he said.

That's why the Cyber Resilience Centre Network exists, funded by the Home Office and free for SMEs and charities. If you're a smaller organisation and you haven't spoken to them, you should.

He also tackled the "we're too small to be a target" argument, which he still hears all the time. The crime data says otherwise. And if a state-backed group is prepared to spend five months inside one of the best-resourced exchanges in the world, the small supplier that connects into a larger customer's systems doesn't look like such an unlikely target.