Binance fraud and prompt injection: criminal challenges of artificial intelligence
A cyber attack on Binance resulting in losses of 6.34 billion dollars illustrates the legal risks of manipulating AI systems. JURIDICE.ro analyses the criminal implications of prompt injection attacks.
The Binance attack and new forms of cybercrime through AI
On 29 October 2026, the cryptocurrency trading platform Binance was targeted by a large-scale cyber attack, following which digital assets valued at approximately 6.34 billion dollars were compromised. According to the preliminary report published by the company on 3 November 2026, the attack was prepared over several months and combined techniques of social engineering, malicious programmes, compromise of employees' devices and exploitation of blockchain transaction authorisation mechanisms.
According to JURIDICE.ro, at a decisive stage of the operation, the attackers used an internal artificial intelligence tool to expand the compromise of the company's IT infrastructure, thereby obtaining access to credentials and permissions that facilitated unauthorised transfers of cryptocurrency.
Prompt injection: when text becomes a weapon
The Binance incident draws attention to a significant development: artificial intelligence is no longer merely a tool for protection against cyber attacks, but can become a component of the mechanism through which they are carried out. The Binance report does not establish that the AI tool was manipulated through a prompt injection attack, but the circumstances described raise questions with important legal implications.
Unlike traditional cyber attacks, which involve the exploitation of software vulnerabilities, use of malicious programmes or compromise of authentication mechanisms, prompt injection attacks exploit a particular characteristic of systems based on linguistic models. Instructions introduced into content processed by these systems can be interpreted and followed as if they came from an authorised source. A simple sequence of text, formulated in natural language and devoid of executable code, can cause an AI agent to access protected information, modify data or initiate unauthorised IT operations.
The questions criminal law must answer
From the perspective of criminal law, the novelty of this mechanism raises problems that cannot be resolved exclusively by reference to the technical classifications of cyber attacks. If an AI agent possesses the necessary permissions to access an IT system, but is caused by an unauthorised person to use them for other purposes, can that person be considered to have carried out access without right? Under what conditions can operations executed by the system constitute alteration of data integrity, unauthorised transfer of IT data or a manner of realising IT fraud?
Another issue concerns criminal liability when between the instruction formulated by the author and the result produced intervenes an AI system whose behaviour is not always fully predictable. Establishing causality, the subjective element and digital evidence represent additional challenges for which current criminal legislation does not offer explicit solutions.
The applicable Romanian legal framework
The analysis examines the conditions under which conduct carried out through prompt injection attacks can be subsumed to the incrimination norms existing in Romanian criminal legislation. The offences in question include illegal access to an IT system, alteration of integrity and unauthorised transfer of data, IT fraud and IT forgery.
The declared objective of the analysis is not to identify a new category of offences, but to verify the extent to which recent technological mechanisms can be framed within existing norms, with respect for the principle of legality. The distinction between simple manipulation of the behaviour of an AI system and conduct that acquires criminal relevance constitutes the central stake of this approach.
Technical characteristics complicating legal classification
Generative artificial intelligence systems integrated into IT applications, databases and organisational infrastructures present characteristics distinct from traditional IT programmes. Their behaviour is not determined exclusively by explicit instructions from programmers, but can be influenced by the content they process — including instructions formulated in natural language by unauthorised third parties.
This characteristic complicates the analysis of authorisation, intention and the causal link between the attacker's action and the result produced. Questions concerning digital evidence are equally difficult: how is it demonstrated that a specific instruction determined particular behaviour of the AI system, given that the internal processes of these systems are not transparent?
The necessity of interpreting norms in accordance with technological development
The increasingly frequent integration of AI agents in organisational infrastructures means that the prompt injection issue becomes increasingly relevant for criminal law practitioners. The mechanism illustrates a fundamental tension: the existing incrimination norms were conceived for cyber attacks with a different architecture, in which the human actor and the technical system are more easily separated.
The analysis published by JURIDICE.ro seeks to highlight the necessity of interpreting these norms in accordance with the principle of legality, without artificially extending the scope of application of existing offences, but without leaving unpunished conduct that produces the same type of harm as classical cyber attacks. Technical explanations represent, in this approach, the starting point for the essential problem: identifying the boundary between manipulation of an AI system and an act with criminal relevance.
Source: JURIDICE.ro