In the $6.34 Billion Binance Heist, How Did Hackers Use Internal AI Agents to Conduct the Infiltration?

Author: Mehab Qureshi (TheStreet)

Compiled by: TechFlow

TechFlow Digest: In the investigation report released by Binance into the largest-ever $6.34 billion cryptocurrency theft incident, a technical detail that shook the entire tech industry and financial system emerged: after compromising peripheral employee endpoints via fake job interviews, attackers bypassed traditional malicious scripts for internal lateral movement and instead directly invoked and co-opted Binance’s internally deployed enterprise-grade AI assistant agents.

In a TheStreet column, the founding team at Mace AI, a leading enterprise AI security defense firm, deeply dissected the technical mechanics behind this attack. They noted that in their rush toward intelligent transformation, modern enterprises often grant internal AI tools elevated privileges to call across codebases and microservices, while overlooking the vulnerability of traditional security guardrails against adversarial prompting and cognitive attacks. This incident thoroughly shatters the myth that "internal AI is inherently safe," serving as a systemic wake-up call for every organization embedding autonomous agents into core business workflows.

The official post-incident investigation report published by Binance revealed that the hackers behind the platform's $6.34 billion massive fund theft directly exploited Binance's internally deployed enterprise-grade AI tools to deeply penetrate its core architecture during a complex attack chain spanning several months.

Walton Comer, co-founder and CEO of enterprise AI security firm Mace AI, subsequently provided an in-depth analysis of the attack mechanism in the column, issuing a stern warning: most enterprises are completely unprepared for this new type of attack surface.

This security incident, regarded as the highest-stakes event in the history of cryptocurrency assets and fintech, not only exposed vulnerabilities in terminal defense at traditional centralized institutions but also posed an unprecedented and severe question to the entire tech industry: when internal AI agents become the most vulnerable systemic liability for enterprises, how exactly should we control them?

Multistage Penetration: Long Concealment and Bridgehead Construction Behind Fake Recruitment

According to the joint post-mortem report released by Binance's security team and multiple third-party forensic firms, this catastrophic attack involving billions of dollars was far from a traditional single-point vulnerability exploit; rather, it was a meticulously planned long-term social engineering and cyber infiltration campaign carried out by a hacker group with a specific state background.

The attack operation quietly began months ago. The hacker team fabricated highly deceptive recruiter identities on professional social networks and conducted customized fake technical interviews targeting specific developers.

During interview communications and coding tests, attackers induced an operations engineer on Binance's wallet infrastructure team to download and run a malicious package containing a hidden backdoor on his work computer.

The malicious code successfully bypassed conventional endpoint detection mechanisms, granting the attackers local access control over the compromised engineer's device. However, the engineer's personal account permissions were strictly restricted and could not directly touch the core hot/cold wallet signing systems.

Had they followed a traditional network attack path, the hackers would have next had to carefully scan ports, sniff traffic, or exploit privilege escalation vulnerabilities to perform lateral movement within the complex corporate intranet, which would easily trigger anomaly alerts from the enterprise's Security Operations Center (SOC).

But unexpectedly, hackers chose an entirely new shortcut in this operation: they targeted the internal enterprise-integrated AI development assistant used daily by the engineer.

Privilege Gap: Why Internal AI Agents Possess Higher System Permissions Than Human Employees

In his analysis, Walton Comer revealed a security blind spot long ignored by the vast majority of enterprise architects: AI agent tools deployed by enterprises often possess system permissions and data access visibility far exceeding those of ordinary human employees.

Within modern large tech companies, to boost the R&D collaboration efficiency of all staff, enterprises typically deeply integrate AI assistants with internal code repositories, API documentation, microservice topology databases, and configuration management systems.

To allow AI agents to smoothly answer employee inquiries regarding cross-departmental architecture and assist in code generation, system administrators often defaultly grant these agents extremely high-level cross-domain read permissions and service tokens.

This leads to an extremely dangerous "privilege mismatch": a junior developer may be unable to directly access the internal APIs and server configurations of core confidential microservices, yet when they pose a natural language query to the internal AI, the AI possesses full authorization to read these configurations and compile outputs.

Once hackers controlled the victim employee's work computer, they instantly inherited the entire contextual environment required to interact with this internal AI tool.

For attackers, this internal AI is no longer merely a productivity assistance plugin, but a "master key" mounted deep within the intranet, aware of the complete system secrets.

Cognitive Jailbreak: How Hackers Deceived Core Topology and Credentials Through "Polite Conversations"

After gaining entry to interact with the internal AI, attackers did not attempt to crack any complex, high-strength underlying encryption algorithms. Instead, they skillfully employed multi-turn prompt engineering to gradually dismantle the AI's security defense boundaries through seemingly ordinary "polite conversations."

Greg Frank, Chief Scientist at Mace AI, pointed out that the security guardrails currently configured for AI agents by the vast majority of enterprises are essentially keyword filtering rules or shallow intent classifiers designed around external inputs.

These traditional guardrails can still intercept crude commands like "directly demand private keys," but their defenses quickly collapse when faced with senior penetration testers who deeply understand the cognitive logic of large models.

Hackers simulated the working context of daily development troubleshooting, posing multiple rounds of seemingly reasonable technical consultations to the AI in a step-by-step manner.

They guided the AI to map out the service invocation dependencies between different R&D teams inside Binance, gradually extracting the specific system environment and intranet location of the second senior engineer responsible for developing the core wallet signing service.

Under this carefully orchestrated series of semantic inducements, the internal AI not only innocently disclosed classified network topology structures but even assisted the hackers in extracting key configuration clues needed for further infiltration.

All security mechanisms originally designed to prevent internal leaks went completely silent when confronted with the active cooperation of the AI agents they themselves trusted, allowing hackers to effortlessly achieve cross-level jumps from standard endpoints to core signing nodes.

Bypassing Private Keys: Review of the Mechanism to Force Takeover of Batch Signing Services

According to the final forensic results disclosed officially, in this colossal case, the underlying core private keys of Binance's hot and cold wallets were never directly leaked, which is precisely what makes this attack most concealed and lethal.

After completing lateral bridgehead penetration with the aid of the internal AI, attackers successfully infiltrated and hijacked the authentication verification logic of the wallet signing microservice.

Hackers did not attempt to forcibly extract private keys from Hardware Security Modules (HSM) or protected isolated environments. Instead, they utilized the acquired high-level service credentials to forge legitimate internal invocation requests.

They forcibly coerced Binance's automated signing engine itself to legally sign large-value malicious transfer instructions, deeply integrating on-chain batch account abstraction authorization mechanisms based on Ethereum's EIP-7702 standard.

Because these transaction instructions carried valid signature endorsements from the exchange's official signing service on-chain, early on-chain anomaly detection radars initially misclassified them as routine large-volume internal transfers between hot and cold wallets.

When the exchange security team detected fund anomalies and urgently paused traditional frontend withdrawal channels, hackers had already drained hundreds of token assets through the batch execution logic of underlying smart contracts in a very short period.

Double Agent Scenario: Enterprise-Level Autonomous Agents Are Becoming Hackers' Most Ideal Internal Backdoors

The Mace AI team's post-mortem brought painful reflection to the tech and finance industries fully stepping into the Agentic era: if top global security operations teams cannot stop internal AI from handing over the system keys, then current enterprise AI security defense lines are undoubtedly useless.

Walton Comer emphasized that the ultimate goal of traditional network security defense is to guard the "vault keys," but in today's era where autonomous AI agents are widely deployed, the AI itself already holds that key legally in advance.

When attackers can turn digital employees within the system simply by using a meticulously crafted natural language prompt, AI has factually transformed into a "double agent" lurking deepest within the enterprise.

As major institutions rush to connect autonomous agents to corporate core codebases, continuous integration pipelines, and asset dispatch hubs, they must re-examine the mandatory implementation of the "principle of least privilege" in the context of AI.

Relying solely on moral guardrails or plug-in rule bases provided by model vendors will absolutely not withstand high-dimensional cognitive attacks. The industry urgently needs to establish an interpretability audit and multi-agent adversarial validation defense architecture that spans the entire lifecycle of agents.

Binance's $6.34 billion theft incident has sounded a definitive alarm for our era: how to prevent internally developed AI agents, armed by humans themselves, from becoming the deadliest blade in hackers' hands to dismantle entire corporate buildings, is a life-or-death exam that everyone faces and must answer head-on.