I just read Binance's official security report released on November 3rd regarding the $6.34 billion theft on October 29th. I see many people analyzing the technical aspects, but I find the social engineering side more interesting. The first major security incident in the AI era—AI was involved at every step, how cool! 1. In June, a wallet team's highly privileged DevOps member downloaded a tampered AI programming tool while trying to learn AI. They were immediately warned by the security team, and their entire computer was compromised. At this point, the hacker team "got to know" all the wallet team's engineers. 2. Engineer B from the team received a high-paying job offer in September. They wanted him to be the CTO. This is where I started laughing. Anyone who's worked at a large company knows that even watching porn on the company computer is broadcast live to the security team. This guy, to get the CTO interview, definitely bypassed the security team's monitoring and went for the online interview. The interviewer, the company behind him, the interviewer's personal photos on social media—everything was AI-generated fake. After the interview, the interviewer gave Engineer B some homework. Engineer B moved the entire interview assignment's code repository to their local machine, gaining control of their computer without being detected by the security team. 3. The hacker used an internal AI tool on Engineer B's computer to regain control of Engineer A's computer and the computer of junior engineer C. They discovered Engineer A's container deployment permissions, which can be interpreted as high-level permissions to deploy programs into the system. 4. However, learning from their previous experience with Engineer A, which was discovered by the security team, the hacker didn't directly use Engineer A's computer. Instead, they used the permissions obtained from A to log into Engineer C's computer and deploy a malicious container. They successfully gained control of the hot wallet's approval permissions. 5. Um. Here's a complaint about Binance's hot wallet's MPC solution. Given that the MPC wasn't cracked and the private key wasn't necessarily stolen, simply using approval and stamping permissions to take away withdrawal rights... Does this mean the blockchain technology involved is low-level? Ultimately, it's still a centralized solution. The key wasn't lost, but the lock was broken. This article is mainly for entertainment; no serious analysis is provided here. In summary: Engineer A had extremely high privileges but relatively low skill levels, though his enthusiasm for learning AI was incredibly high. He was compromised twice without realizing it. The security team already averted disaster once. Engineer B, somewhat frustrated and cunning, secretly interviewed for the CTO behind the company's back and was tricked by a North Korean, letting the enemy in. Engineer C did nothing but was also a direct culprit; he didn't even have proper privileges. However, the hacker used stolen privileges to launch an attack on his computer. If this were a state-owned enterprise, C would likely be the scapegoat. Furthermore, whether it was Engineer A downloading a virus to his home to learn AI programming, or the hacker later being able to freely use Binance's internal AI development tools across the core technical team's computers, it all relied on the technical team's high level of AI integration. Oh, and I guess the photo and video editing that fooled Engineer B also relied on AI. This can be considered the biggest blow the AI industry has dealt to the blockchain industry to date.