Art Gilliland, CEO of Delinea, on Why the Binance Incident Exposes the Risks of Privileged Access

When Trusted Systems Become a Security Risk

The growing sophistication of cyberattacks is challenging one of the fundamental assumptions of enterprise security: that trusted systems and authorised processes can be relied upon to protect critical operations.

The recent security incident involving Binance, one of the world's largest cryptocurrency exchanges, has brought this challenge into focus. On October 29, 2026, approximately $6.36 billion in digital assets moved out of Binance-controlled wallets across multiple blockchain networks, according to blockchain intelligence firm TRM Labs. The incident has become one of the largest cryptocurrency thefts recorded.

What makes the incident particularly significant is the apparent method through which the attackers gained control. Binance's initial investigation found no evidence that wallet private keys had been leaked. However, TRM Labs assessed that the attacker most likely gained the ability to make Binance's hot-wallet signing infrastructure authorise transactions of their choosing.

The distinction is important. Rather than simply stealing the keys used to authorise transactions, the attacker appears to have exploited the systems responsible for processing and signing them.

Although the full technical details and root cause remain subject to further investigation, the incident highlights a broader security challenge facing organisations: protecting not just their systems and credentials, but also the permissions and trusted processes through which critical business operations are performed.

The Expert Perspective: Privileged Access Is Becoming a Critical Security Priority

For Art Gilliland, CEO of Delinea, the incident reinforces the importance of understanding what compromised credentials can actually access and the extent of the damage they can cause.

Art argues that organisations must move beyond simply preventing unauthorised entry and focus on limiting the privileges available to employees, service accounts and increasingly autonomous AI agents.

Commenting on the implications of the Binance incident, Art Gilliland said:

"The compromised credentials in the Binance breach likely had elevated permissions, otherwise the hackers would not have been able to extract over $6 billion. Once attackers get inside an organization, the damage they can make depends on what they're able to access and what that access allows them to do.

The flood of incidents in the past month should push every business leader to look closely at their access controls. Employees, service accounts and increasingly AI agents shouldn't have standing access to powerful permissions sitting. Give them access when they need it and remove it when the job is done.

Always assume an attacker will find a way in, and plan to limit what they can do once there. That can make the difference between a contained incident and a crisis for the whole business."

---

KARV Editorial Analysis: The Security Challenge Is No Longer Just About Preventing Access

The Binance incident highlights an important evolution in cybersecurity thinking. Organisations have traditionally invested heavily in perimeter protection, authentication mechanisms and measures designed to prevent unauthorised users from entering their systems.

These remain essential, but they are only part of the security equation.

Once an attacker gains access through a compromised account, an exposed credential or an exploited internal process, the permissions associated with that identity can determine how far the attack progresses.

This is where identity security and privileged access management become particularly important.

A compromised account with limited permissions may create a contained security incident. The same compromise involving an account with administrative privileges or access to critical infrastructure could have significantly wider consequences.

The challenge for security leaders is therefore not simply determining who can enter a system. It is understanding what each identity can do once access has been granted, which resources it can reach and whether its permissions are appropriate for the task being performed.

1. Privileged Access Must Be Limited, Not Assumed

Privileged accounts are often necessary for managing infrastructure, accessing sensitive information, maintaining applications and performing critical business operations.

However, leaving powerful permissions permanently available creates additional opportunities for attackers.

The principle of least privilege offers a way to reduce this exposure. Under this approach, employees, applications and service accounts receive only the permissions necessary to perform their specific responsibilities.

Organisations can strengthen this approach through just-in-time access, where elevated permissions are granted temporarily when required and automatically revoked once the task is completed.

This reduces the window in which compromised credentials can be used to access sensitive systems or perform unauthorised actions.

It also reinforces the importance of continuously reviewing permissions rather than treating access approval as a one-time security decision.

2. Trusted Systems Need Continuous Oversight

One of the broader lessons from the Binance incident is that legitimate system processes can become potential attack pathways when the mechanisms controlling them are compromised.

A transaction may carry a valid signature, an application may authenticate successfully and an account may appear authorised. Yet the underlying request could still be malicious.

This creates a need for security controls that examine more than identity verification alone.

Organisations must consider whether an action is expected, whether the request follows established approval processes and whether the requested operation is consistent with the identity's intended responsibilities.

Monitoring privileged activity, enforcing separation of duties and introducing additional approval requirements for sensitive operations can help identify suspicious activity before it escalates.

The objective is to ensure that trusted systems do not automatically become unrestricted pathways for attackers who gain access to them.

3. AI Agents Introduce a New Layer of Identity Risk

The expansion of AI agents across enterprise environments adds another dimension to identity and access security.

Organisations are increasingly exploring AI agents that can interact with business applications, retrieve information, execute workflows and perform tasks with limited human intervention.

For these systems to operate effectively, they often require access to company data, applications and internal services.

However, granting AI agents broad or persistent permissions can introduce risks similar to those associated with overprivileged human accounts.

An agent operating with excessive access could potentially expose sensitive information or execute actions beyond its intended purpose if its credentials, instructions or execution environment were compromised.

As AI adoption accelerates, organisations will need to establish clear identity boundaries for these systems.

That includes assigning unique identities to agents, limiting their permissions, monitoring their activities and ensuring that sensitive actions require appropriate human oversight.

AI agents should be treated as identities that require governance, rather than simply as software tools operating outside traditional security controls.

What Security Leaders Should Priorities

The implications extend beyond cryptocurrency exchanges. Any organization relying on interconnected applications, cloud infrastructure, privileged accounts and automated workflows needs to understand the potential consequences of excessive access.

For security leaders, several priorities stand out:

• Review privileged permissions: Identify accounts with access to critical infrastructure and sensitive business resources, and remove unnecessary privileges.

• Adopt just-in-time access: Replace permanent elevated permissions with temporary access granted only when required.

• Strengthen identity monitoring: Track unusual access patterns, unexpected privilege escalation and suspicious activity involving service accounts.

• Secure automated identities: Apply the same identity governance principles to applications, service accounts and AI agents as those used for human employees.

• Strengthen approval mechanisms: Introduce additional verification and separation of duties for sensitive transactions and administrative operations.

• Plan for containment: Assume that preventative controls may eventually be bypassed and establish safeguards that limit the potential impact of a compromise.

These measures cannot eliminate every cybersecurity threat. However, they can reduce the level of access available to an attacker and limit the potential damage when an incident occurs.

The Bigger Picture: Security Must Account for What Happens After Access Is Granted

The Binance incident reinforces a broader shift in enterprise cybersecurity. Protecting systems from unauthorized entry remains essential, but organizations must also prepare for situations in which attackers gain access through legitimate credentials or manipulate trusted processes.

As enterprise environments become more interconnected and AI-driven, the number of identities interacting with sensitive systems will continue to expand.

Employees, third-party applications, service accounts and autonomous agents will increasingly perform operations that require access to critical business resources. Managing those permissions will become an increasingly important part of maintaining organizational security.

For business and technology leaders, the priority is no longer just to determine who can access a system. It is to establish clear boundaries around what every identity is permitted to do, when that access is available and how its activities are monitored.

The distinction between a contained incident and a major security crisis may ultimately depend on how much authority an attacker can gain after getting inside.

About Art Gilliland

Art Gilliland is the CEO of Delinea, an identity security company focused on helping organizations secure access to critical systems, manage privileged identities and protect sensitive resources.

His commentary highlights the growing importance of privileged access management and identity security as organizations face increasingly sophisticated credential-driven attacks.

---

About Delinea

Delinea is an identity security company that helps organizations manage and secure access to critical systems, infrastructure and sensitive information. Its solutions support privileged access management, identity governance and access security across modern enterprise environments.

---

Source & Credits

Expert Commentary: Art Gilliland, CEO, Delinea.

Editorial Analysis: KARV Tech Insider Editorial Team.