Cybersecurity

The Binance case is a wake-up call: AI is changing the rules of the game when it comes to cyberattacks

More attacks, halved propagation times and falling costs: according to experts, cyber threats are undergoing a ‘species leap’

by Mara Monti

31 October 2026

Aggiungi Il Sole 24 Ore
ai preferiti su Google

3' min read

Translated by AI

Versione italiana

3' min read

Translated by AI

Versione italiana

The Binance case, the $6.3 billion cyberattack, tells a new story: cybersecurity is undergoing a paradigm shift. Cyberattacks are more numerous, faster and cheaper to carry out, thanks in part to artificial intelligence. This is the ‘quantum leap’ which, according to Fabio Momola, general manager of digital solutions at Engineering Group – an Italian company specialising in digital transformation with a presence in 22 countries – helps us to understand the Binance case and, more generally, the evolution of digital threats.

The figures illustrate the scale of the phenomenon. According to data from the Clusit 2026 report cited by Momola, serious incidents have risen by 49 per cent globally and by 42 per cent in Italia. At the same time, the average time between the initial compromise of a system and the attacker’s first lateral movement has fallen, according to the CrowdStrike 2026 report, from 48 to 29 minutes.

“We are not only seeing more numerous and faster attacks, but threats that are changing in nature and are capable of adapting to the target’s defences,” observes Momola. AI makes it possible to automatically identify vulnerabilities, select targets and develop tools to exploit them, thereby reducing the time and cost of the operation. Even targets that in the past would have offered an insufficient financial return can thus become attractive.

The Binance case and the risk posed by privileged identities

The Binance incident, with a reported value of 6.3 billion dollars, is a prime example of the economic scale involved and the issues it raises regarding the security of digital infrastructure. Momola, however, urges caution: the information available does not allow us to reconstruct the sequence of events surrounding the attack with any certainty.

“What seems to be the case is that it all started with a device being compromised,” he explains, referring to reports concerning the computer of a DevOps engineer – a role that may have privileged access to company systems. “It would appear that an identity has been compromised,” he clarifies, emphasising that these are details yet to be confirmed and not definitive conclusions.

The key point, beyond the reconstruction of this individual incident, is the strategic value of identities and access: compromising an account with elevated privileges can open the door to critical systems and resources. For this reason, security cannot be limited to protecting the IT perimeter, but must also encompass people, credentials and processes.

From prevention to the ability to respond

In the face of rapidly evolving threats, simply updating traditional tools is no longer enough. ‘If someone uses AI to launch an attack, you cannot defend yourself without AI,’ says Momola. Defences must harness the same technological capabilities to continuously monitor infrastructure, detect subtle signs and recognise anomalous behaviour before it results in damage.

Prevention remains key: understanding the vulnerabilities affecting your systems, applying patches promptly and investing in staff awareness. But no organisation can consider itself immune. It is therefore essential to plan for the post-incident phase as well, with segmented systems to prevent the spread of the incident, reliable backups and tried-and-tested recovery procedures.

“You don’t prepare for the worst afterwards: afterwards, you put into action measures that have already been planned, defined and tested,” emphasises Momola. The ability to contain an attack and restore operations thus becomes an integral part of the security strategy, on a par with prevention.

Furthermore, the risk does not only affect large organisations. Through attacks on the supply chain, a less secure supplier can become a gateway into a more established business. “Interconnectedness also means risk when someone in the chain is less robust,” observes Momola.

The challenge, therefore, lies not merely in acquiring new technologies, but in narrowing the speed gap between attackers and defenders. In a context where artificial intelligence is accelerating the capabilities of both sides, digital resilience depends on the ability to anticipate threats, limit their spread and continue to operate even when prevention has proved insufficient.