Skip to content
redactsure
Book a demo

Explore.

Breach Analysis · AI Agents and Application Security
Chris Sowa, Co-Founder and Chief Commercial Officer, RedactSure
Published
Last updated

After Binance, It Is Clear AI Is Putting Financial Institutions and Their Customers at Risk

Summary: Binance, the world's largest crypto exchange, says about $6.3 billion was stolen in a single attack this week, most of it in roughly 20 minutes. The same month, CrowdStrike reported that an attacker used an agentic AI hacking tool against South Korean banks and exposed client data. Large financial institutions are being hit first because the prize is largest, but the weakness they share is common: trusted sessions and application screens that show far more customer data than the work requires. AI tools make that weakness faster and cheaper to exploit, and every company holding personal information should plan on being next.

A privacy screen turns browser data into tokens before it reaches an AI node.

In 1900, thieves used explosives to blow open the safes in banks and post offices (U.S. Postal Inspection Service, n.d.). In 2026, they use AI tools and agents to blow open the virtual ones. The vault has changed and so have the tools, but the target is the same: the place where the money and the customer data sit.

What happened at Binance

Executives at every financial institution should read the Binance numbers closely. According to Al Jazeera, citing blockchain analysts TRM Labs and Chainalysis, an attacker moved about $6.36 billion out of Binance wallets across 10 blockchains, with most of the theft taking place over about 20 minutes late on Thursday (Al Jazeera, 2026). That makes it the largest crypto theft on record, more than four times the $1.5 billion taken from Bybit in February 2025.

Binance said the breach may have started with a hacked laptop belonging to one of its engineers, and on Friday said it had found "additional points of breach." For scale, the loss is more than six times the size of Binance's own $1 billion emergency fund for users.

TRM Labs and Chainalysis both attributed the attack to TraderTraitor, a North Korean unit linked to the Lazarus Group. Coinbase said it was not affected, yet its shares still fell sharply as the news spread across crypto markets (Al Jazeera, 2026). The damage from one breach does not stay inside the company that was breached.

AI tools are now part of the attacker's kit

AI tools are now being used against financial institutions. For example, in October 2026 CrowdStrike reported that a financially motivated attacker used ARTEX, an agentic AI penetration testing tool, together with commercial AI models, to break into South Korean financial institutions between late September and early October. According to the Korea Herald, the compromised systems included one bank's loan inquiry service used by financial brokers and another bank's mobile work support system for employees (Korea Herald, 2026). BleepingComputer reported that client personal data and credit card information were exposed, and that the attacker asked an AI model to suggest Telegram groups where Korean data is sold (BleepingComputer, 2026).

The groups blamed for the largest crypto thefts use the same tools. Google's Threat Intelligence Group reported that North Korean actors used its Gemini model to research cryptocurrency concepts and the wallet applications their targets use, and to "enhance all stages of their operations" (NK News, 2025, reporting on Google Threat Intelligence Group).

The step from AI as an assistant to AI as the operator has already been documented. In November 2025, Anthropic reported disrupting a campaign by a group it assessed as Chinese state sponsored that targeted roughly 30 organizations, including financial institutions. The AI carried out 80 to 90 percent of the work: reconnaissance, writing exploit code, harvesting credentials and extracting data, at a peak of thousands of requests, often several per second. Anthropic concluded that "The barriers to performing sophisticated cyberattacks have dropped substantially" (Anthropic, 2025).

This means the attacker no longer needs a large team to work through a target. A tool that can read, test and act at machine speed can do in minutes what used to take weeks, and it can do it against many companies at once.

Why the door is open at almost every company

Most application security was designed for a world in which a person signs in, does a task and logs off. It controls who gets in. It does far less to control what that person, or that program, sees once inside.

Look at what a typical business application draws on the screen. A loan servicing screen shows the borrower's name, Social Security number, income and account numbers. A support console shows the customer's address, date of birth and card on file. The task in front of the user often needs almost none of it, yet every field is rendered for anyone, or anything, holding a valid session.

People have exploited this for years. In 2025, Coinbase disclosed that criminals paid "multiple contractors or employees working in support roles outside the United States" to collect customer information from systems those workers could already reach, and estimated the cost at "approximately $180 million to $400 million" (Coinbase, Form 8-K, 2025). No one broke the application. The data was simply on the screen.

AI agents read the same screens. An agent working in a browser or a business application reads every field, every time, and passes the text into a model. OWASP lists the consequence directly: "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, LLM02, 2025). An attacker who takes over one trusted session, whether by compromising an engineer's laptop, bribing a support worker or hijacking an agent, inherits everything that session can see.

Executives are disclosing the risk, not closing it

Executives know this risk exists. RedactSure read the latest annual report each of the 100 largest US public companies filed with the SEC: 87 of the 100 describe using AI in their business, and at least 55 of those 87 warn investors about it in the same filing. Financial institutions follow the same pattern: at least 24 of the 46 largest banks and at least 24 of the 42 largest insurers warn investors about AI (RedactSure, How Many Large Companies Are Warning Their Investors About the Risks of AI?).

Some of these disclosures describe the threat precisely. For example, JPMorgan Chase, the largest US bank, told investors it expects "a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions and emerging technologies that can be leveraged by attackers, including artificial intelligence" (JPMorgan Chase, Form 10-K, 2026).

Executives are covering themselves legally, but most are not yet investing in what it takes to protect their own companies. A risk factor in a 10-K tells investors the danger was disclosed. It does not protect a single customer record, and it will not stop an attacker holding a trusted session. The controls that would are still rare. For example, of 15 AI agents and 86 AI security products RedactSure reviewed, none describes replacing the customer data an agent reads on a screen with tokens it can work with (RedactSure, How Many AI Security Products Control What an AI Agent Sees?). This means most institutions have written the warning and few have done the work the warning describes.

What financial institutions should do now

Attackers are starting with the largest institutions because that is where the money is. The techniques that worked there will reach mid-sized banks, insurers, lenders, payment companies and healthcare organizations next, because their screens show the same kinds of data and their sessions are trusted in the same way.

Security and operations leaders should take three steps:

  1. Inventory what each screen shows. For each workflow where people or AI agents work, list the personal and financial fields displayed and compare them with what the task actually requires.
  2. Assume a trusted session will be compromised. Plan for the engineer's laptop, the outsourced representative and the AI agent alike. Ask what an attacker holding that session could read and move in 20 minutes.
  3. Hold back real values until they are needed. Where a workflow must use a real account number or card, release it at the approved destination, with a named person approving the action and a record of what was seen and done.

Boards will ask whether their institution could absorb a loss like this one. The more useful question is how much customer data any single session can see today.

How RedactSure addresses this

RedactSure controls what reaches the screen. Inside the RedactSure environment, personal and financial values chosen by policy are replaced with consistent tokens before an AI agent or a person sees them, so the work gets done while the real data stays hidden, as described in What Is Render-Layer Tokenization?. A real value is released only at an approved destination when a named person approves the action, under Supervised Delegation, and every screen read, action proposed and approval given is kept in the AI Control Record. RedactSure runs on secure compute, so even we cannot see the critical personal and account information. A hijacked session inside that environment finds tokens, not customer data.

To see how this would apply to your own workflows, book a demo.

Sources

Book a demo

Book a demo

Having trouble? Open the booking page or email us.