North Korea supercharges crypto heists with AI skills

The North Korean group accused of the world’s largest-ever crypto heist is a state-sponsored collective of elite hackers, groomed from an early age to hunt for “big game.”

Artificial intelligence (AI) has now provided them with a powerful new tool to swell Kim Jong-un’s coffers and fund his military expansion.

Nuclear-armed North Korea maintains a thousands-strong hacker army, but the top unit known as “TraderTraitor,” which the FBI blames for the recent US$6.3 billion Binance hack, might only have a dozen or so members, experts said.

North Korean leader Kim Jong-un visits a drone warehouse during the “Unmanned Aeronautical Technology Development” exhibition in North Korea on Thursday.

Photo: EPA / North Korean Central News Agency

Unlike garden-variety hackers targeting individual investors, TraderTraitor uses a strategy known as Big Game Hunting, cybersecurity experts said, helped by AI to seek out high-value crypto businesses to compromise.

They have been so remarkably successful that the revenues they generate could be funding nearly half of North Korea’s banned weapons programs.

“This particular group looks for a big haul,” said Park Seong-su, staff threat researcher at cybersecurity firm Zscaler. “They target crypto-related businesses, gain an understanding of their infrastructure and then tamper with it — or fund transfer processes — to execute a large-scale theft.”

With new AI tools “the barriers to such skills have dropped significantly, while the speed at which these operations can be carried out has increased tremendously,” Park added.

For decades, North Korea has picked its best and brightest students to join its hacking teams, training them at specialized institutions such as Moranbong College in Pyongyang, defectors and experts said, to create an army that is now believed to be responsible for 89 percent of reported crypto hack losses this year, according to Chainalysis.

From running laptop farms in the US to stealing billions of crypto in less than 30 minutes, its hackers have become one of the most important sources of revenue for North Korea, which is isolated from the global financial system due to rafts of sanctions over Kim’s nuclear weapons and ballistic missile programs.

North Korea’s other income sources, such as trade with China and even the military relationship with Russia, are dwarfed in significance by crypto cash. Once, Pyongyang was smuggling cigarettes and forging US dollar bills to stay afloat — now its hackers bring in billions in pure profit from a single successful heist — and it could be getting worse, thanks to AI.

Novel techniques employed by TraderTraitor suggest the group is making ample use of AI in its recent hacks, TRM Labs senior investigator Nick Carlsen said.

They are certainly breaking new revenue records: Their previous largest hack was last year’s US$1.5 billion Bybit heist.

Crypto exchanges are beefing up security, especially for employees with key access, to protect against TraderTraitor’s modus operandi: combining top-tier hacking skills with social engineering.

They have been known to identify employees with high-level access to target systems and aggressively pursue them with things such as lucrative job offers, Carlsen said.

“Their bread and butter is the human part,” he said.

Binance has said an initial investigation found a compromised laptop belonging to an engineer as a point of breach. In just 20 minutes, hackers stole US$6.36 billion in cryptocurrency, worth nearly 20 percent of North Korea’s estimated annual economic output. With roughly US$2.8 billion frozen in its aftermath, net outflows amount to US$3.6 billion.

“For the Kim Jong-un regime, cryptocurrency hacking has evolved beyond merely a criminal means of making up for foreign currency shortages,” said Lim Eul-chul, professor at the Institute for Far Eastern Studies, Kyungnam University.

As the US devotes significant resources to conflicts in the Middle East and efforts to counter China and Russia, its capacity to actively engage on the Korean Peninsula has diminished, some closer observers of North Korea said.

“North Korea is exploiting this period as a golden opportunity to accelerate the development of its military capabilities,” Lim said.

In 2024, UN experts said North Korea’s cyberthefts and illicit financial activities could be funding about 40 percent of its weapons of mass destruction programs. Every successful crypto heist adds to Kim’s ability to build out his army and threaten US ally South Korea, along with the 28,500 US troops stationed on the Korean Peninsula.

Nuclear weapons and ballistic missiles have always been top priorities for the regime and its cash, “but now there seems to be enough to support conventional forces, including new naval vessels, investments in drone tech,” said Adam Farrar, a former director on the US National Security Council covering Korea in the administrations of US President Donald Trump and former president Joe Biden.

North Korea might still be decades behind South Korea’s military in many ways, but maybe not for much longer, said Farrar, now a senior analyst at Bloomberg Economics.