A fake job interview, an AI with too many keys and $6.34 billion

He downloads it onto his work laptop.

There was no job. There was a thief knocking at the door. A month later, on 29 October 2026, around $6.34 billion in cryptocurrency left Binance. The FBI attributes the theft to North Korea.

The interesting part is not the amount. It is the route. And halfway along that route is an artificial intelligence system.

The theft, step by step

An office building is all it takes to understand it. The money is in the vault in the basement. The thieves cannot get in through the main entrance. So they move from office to office.

Step 1. June: someone takes an interest in the building. An engineer on the team that manages Binance's wallets, referred to here as A, is looking for an AI coding tool. He downloads a fake program. Binance detects it and replaces his computer and passwords. Problem solved, apparently. But the attackers already knew who A was, what he did and who his colleagues were. They had obtained the building's floor plan.

Step 2. September: they enter an office. With that floor plan, they find another engineer, B, and set up the fake interview. The “technical test” contains hidden spyware. The antivirus software does not spot it. From that moment, the attackers control B's laptop.

Step 3. 20 October: the AI opens more offices for them. From B's laptop, they use an internal AI tool at the company. With it, they take control of the computers of two other engineers on the same team, A and C. They no longer have one office. They have three.

Step 4. The key to the basement. On A's computer, they find a very special credential: permission to install programs on the company's servers. It is like finding, in a drawer, the card that unlocks the lift to the basement.

Step 5. 29 October: the basement. Using C's computer and that credential, they install their own program and reach the service that signs transfers. They sign. The money leaves without going through the normal withdrawal process. For XRP alone, one of the cryptocurrencies, 233 million XRP leave in four minutes, between 20:05 and 20:09. The internal alarm goes off afterwards. The last outflow is at 23:56.

Binance has frozen or recovered around $2.85 billion and says it will cover the losses. Customers do not pay. This time.

What exactly the AI did

Honesty is needed here. Binance has not explained which tool it was, what permissions it had or how the attackers used it. It only says that the tool was involved in step 3 and that it has rebuilt it from scratch, with new controls. Some suspect that the attackers tricked it with malicious instructions. Others believe they simply used it as designed, from a laptop that appeared legitimate. Neither explanation has been proved.

Nor can it be said that the theft would not have happened without AI. Perhaps they would have found another route.

But what is known is enough to cause concern. The attackers had one laptop. Thanks to the AI, they had three. And on one of those three was the key to the basement.

That is the lesson. An AI that only answers questions is a librarian. An AI that acts on other computers is an employee with a bunch of keys. And that employee obeys whoever speaks to it from a company computer, without questioning whether it really is a colleague on the other end.

Companies have spent years teaching people not to open suspicious attachments. Now they are installing assistants that can do in seconds what an employee could not do alone. If someone steals a computer, they also steal the assistant. And with it, all its keys.

What controls an AI with hands needs

Any company or professional firm that gives an AI the ability to act (access systems, move files, run commands, send money or emails) needs controls at three stages.

Before: give it few keys

• The AI must not be able to do more than the person speaking to it. If engineer B cannot access C's computer, neither can the assistant. The AI inherits the user's permissions. It never adds to them.
• Keys for each task, not master keys. Each permission must be for a specific job and a limited time. Once the job is done, it expires.
• Keep dangerous keys off laptops. A credential that allows access to servers must not sit on anyone's computer.
• Separate thinking from doing. The AI can make suggestions. The action is carried out by a system that checks, every time, who is asking, for what purpose and on what target.
• Attack it before the criminals do. Seriously test what happens if someone tricks it or uses it from a stolen computer.

During: someone must watch while it acts

• Record what it does, not just what it says. Saving the conversation is not enough. Records must show which computer it accessed, with what permission, on whose orders and with what result.
• Alarms for unusual behaviour. If an engineer's assistant starts accessing colleagues' computers, that must trigger an alarm immediately, not after the money has already left.
• A speed limit. Limits on amounts, the number of operations and new destinations. If 233 million of something try to leave in four minutes, the system stops automatically.
• A human for irreversible actions. Moving money, deleting data, installing software on servers or sending anything outside the company: confirmation from a person, through another channel and with enough information to say no. A confirmation that the compromised computer itself cannot fake.
• A red button that works. The ability to revoke all the AI's permissions and isolate critical systems within seconds. And this must have been rehearsed.

After: make it possible to reconstruct events and learn

• Be able to tell the whole story. The records must show, step by step, what the AI did, for whom and with which keys. If only the chat remains, only half the story remains.
• Close every door, not just the last one. In June, Binance replaced the computer and passwords, but the attackers kept the floor plan. After an incident, the question must be what the attacker already knows, not just what they have accessed.
• Review the AI's permissions after every incident, even if the AI was not the point of entry.
• An independent review, not just the affected company's account.

The question that needs asking

Binance learned all this the most expensive way. The question for any company or professional firm installing an assistant with the ability to act today is very simple:

If someone steals an employee's laptop tomorrow, what can they do with the company's AI?

If the answer is “the same as the employee, and everything is recorded”, things are on the right track. If the answer is “I don't know”, the starting point is clear.