The short version

Binance says North Korea-linked hackers used fake job interviews and an internal AI tool in a breach affecting about $6.34 billion in digital assets. Nigeria still has no standalone AI law, and Technext24 asks whether its existing cybercrime and data protection laws are enough.

What happened

A breach at Binance on 29 October 2026 affected about $6.34 billion in digital assets, Binance said, according to Premium Times.

The exchange said hackers broke into an internal wallet‑signing service and used it to transfer funds outside the usual withdrawal process, according to Binance.

Binance traced part of the attack preparation to June 2026, when an engineer downloaded a tampered software installation while trying to install an AI coding tool; fake recruitment interviews followed in September. The company described a multi-stage campaign involving fake recruitment interviews, malicious software, compromised employee devices and the misuse of an internal artificial‑intelligence (AI) tool, the company said.

The attack was linked to a North Korean group, a conclusion supported by FBI information cited by Binance and by blockchain intelligence firms TRM Labs and Chainalysis, which also identified the group as TraderTraitor.

Binance reported that it froze or intercepted about $2.85 billion, replenished 98 % of the affected tokens, and set aside more than 100 % of the funds needed to cover the loss, stating it would absorb the remaining impact.

What it means for owners and operators

For owners of crypto platforms, the breach shows that AI tools can accelerate traditional attack techniques. Hackers used an internal AI tool to get into other engineers' machines, meaning that any AI component without strict access controls becomes a liability.

Operational costs are likely to rise as firms invest in AI‑driven threat detection, endpoint protection and stronger credential management. Binance says it has expanded its use of AI to spot unusual behaviour and rebuilt its wallet system.

In markets like Nigeria, the lack of a clear AI regulatory framework adds legal uncertainty. Companies may face scrutiny under existing cyber‑crime and data‑protection statutes, but unclear responsibilities for AI agents could lead to compliance gaps, reputational risk and potential penalties.

Our take

Analysis by Infercline · Who carries the risk

Binance could absorb the loss; a fintech in Nigeria hit the same way, with no AI law to lean on, probably could not.

What went wrong was a multi-stage attack that used AI to speed up old tricks. It used a tampered AI coding tool installer, fake recruitment interviews and compromised staff devices, then misused an internal AI tool to move across the network and reach a wallet-signing service. About $6.34 billion in digital assets was affected, and Binance, citing FBI information, links the group to North Korea.

Who carries the loss here is clear because Binance chose to carry it. It stopped about $2.85 billion, topped up 98 per cent of the affected tokens and put aside more than the full sum needed. That is a balance sheet most businesses do not have. A smaller crypto platform or payments firm in Nigeria, ranked second in the world for crypto adoption in Chainalysis’ 2024 index, would carry the loss on its own books, and with no dedicated AI legal framework it would also face unclear duties under existing cyber-crime and data-protection laws.

The way to move that risk off the books starts inside. Every internal AI tool is an access point, so lock down what it can reach, enforce multi-factor authentication and audit staff devices and credentials. Recruitment is now part of the attack surface, so check candidates before they touch company systems. And write an internal AI use policy now rather than waiting for the law, so there is a record of the controls you chose.

What to do in your business tomorrow

  1. Enforce multi‑factor authentication for every member of staff, starting with anyone who can reach payments or your internal AI tools.
  2. Warn staff that fake job interviews and a tampered AI coding tool installer were both part of this attack, and have them report any unexpected interview offer before opening its links or files.
  3. Run an audit of employee devices and credentials, and reset the login on any device you cannot clear.
  4. Start drafting internal AI usage policies: which staff may use which AI tools, and what each tool can reach.

Sources

  • technext24.com: Hackers now deploy AI against crypto firms: Why is Nigeria’s AI law still missing?
  • premiumtimesng.com: Binance attributes $6.34 billion cyberattack to North Korea, boosts AI security