North Korea’s Hackers Supercharge Crypto Heists With AI Skills
The North Korean group accused of the world’s largest-ever crypto heist is a state-sponsored collective of elite hackers, groomed from an early age to hunt for “big game.” Artificial intelligence has now provided them with a powerful new tool to swell Kim Jong Un’s coffers and fund his military expansion.
Nuclear-armed North Korea maintains a thousands-strong hacker army, but the top unit known as “TraderTraitor”, which the FBI blames for the recent $6.3 billion Binance hack, may only have a dozen or so members, experts say.
Unlike garden-variety hackers targeting individual investors, TraderTraitor uses a strategy known as Big Game Hunting, cybersecurity experts say, helped by AI to seek out high-value crypto businesses to compromise. They’ve been so remarkably successful that the revenues they generate could be funding nearly half of North Korea’s banned weapons programs.
“This particular group looks for a big haul,” said Park Seong-su, Staff Threat Researcher at Zscaler, a cybersecurity firm. “They target crypto-related businesses, gain an understanding of their infrastructure and then tamper with it — or fund transfer processes — to execute a large-scale theft.”
With new AI tools “the barriers to such skills have dropped significantly, while the speed at which these operations can be carried out has increased tremendously,” Park added.
For decades, North Korea has picked its best and brightest students to join its hacking teams, training them at specialized institutions like Moranbong College in Pyongyang, defectors and experts say, to create an army which is now believed to be responsible for 89% of reported crypto hack losses this year, according to Chainalysis.
From running laptop farms in the US to stealing billions of crypto in less than 30 minutes, its hackers have become one of the most important sources of revenue for North Korea, which is isolated from the global financial system due to rafts of sanctions over Kim’s nuclear weapons and ballistic missile programs.
North Korea’s other income sources, such as trade with China and even the military relationship with Russia, are now dwarfed in significance by crypto cash. Once, Pyongyang was smuggling cigarettes and forging US dollar bills to stay afloat — now its hackers bring in billions in pure profit from a single successful heist.
And it could be getting worse, thanks to AI.
Novel techniques employed by TraderTraitor suggest the group is making ample use of AI in its recent hacks, said Nick Carlsen, Senior Investigator at TRM Labs. They’re certainly now breaking new revenue records: their previous largest hack was 2025’s $1.5 billion Bybit heist.
Crypto exchanges are beefing up security, especially for employees with key access, to protect against TraderTraitor’s modus operandi: combining top-tier hacking skills with social engineering. They have been known to identify employees with high-level access to target systems and aggressively pursue them with things like lucrative job offers, said Carlsen.
“Their bread and butter is the human part,” he said.
Binance has said an initial investigation found a compromised laptop belonging to an engineer as a point of breach. In just 20 minutes, hackers stole $6.36 billion in cryptocurrency, worth nearly 20% of North Korea’s estimated annual economic output. With roughly $2.8 billion frozen in its aftermath, net outflows amount to $3.6 billion.
Read more: Record Binance Hack Shows No Crypto Firm Is Too Big to Breach
“For the Kim Jong Un regime, cryptocurrency hacking has evolved beyond merely a criminal means of making up for foreign currency shortages,” said Lim Eul-chul, professor at the Institute for Far Eastern Studies, Kyungnam University.
As the US devotes significant resources to conflicts in the Middle East and efforts to counter China and Russia, its capacity to actively engage on the Korean Peninsula has diminished, some closer observers of North Korea say.
“North Korea is exploiting this period as a golden opportunity to accelerate the development of its military capabilities,” Lim said.
In 2024, United Nations experts said North Korea’s cyber thefts and illicit financial activities could be funding about 40% of its weapons of mass destruction programs. And every successful crypto heist adds to Kim’s ability to build out his army and threaten US ally South Korea, along with the 28,500 American troops stationed on the Korean peninsula.
Nuclear weapons and ballistic missiles have always been top priorities for the regime and its cash “but now there seems to be enough to support conventional forces, including new naval vessels, investments in drone tech,” said Adam Farrar, a former director on the US National Security Council covering Korea in both the Trump and Biden administrations.
North Korea might still be decades behind South Korea’s military in many ways, but maybe not for much longer, said Farrar, now a senior analyst at Bloomberg Economics.
Photograph: Cryptocurrency logos; photo credit: Angel Garcia/Bloomberg
Related: