Credit: Kanchanara on Unsplash
North Korean hackers may be using AI to plan and carry out cryptocurrency thefts, according to security experts cited in a Bloomberg report published on Monday.
They point to the growing complexity and precision of recent attacks, including last week’s record theft from Binance.
The use of AI has not been confirmed, and Bloomberg presents it as the experts’ assessment rather than an established fact.
However, they believe the hackers may be using AI models to research targets, identify weaknesses and trick employees into handing over access to sensitive systems.
The latest warning follows an FBI alert published on Saturday, which blamed North Korea for stealing more than $6bn from Binance, the world’s largest cryptocurrency exchange, on or around 29 October.
The agency attributed the attack to a group known as TraderTraitor, which it has also linked to the $1.5bn theft from Bybit in February 2025.
Binance estimates its losses at around $6.3bn. According to Bloomberg, investigators believe the attackers gained access to a software engineer’s laptop, allowing them to reach the systems responsible for processing withdrawals.
Federico Charosky of cybersecurity firm Quorum Cyber told Bloomberg that one common tactic is to approach exchange engineers through fake job interviews. During the process, victims are persuaded to install malicious code, giving attackers access to their devices and potentially the wider company network.
“This is an inflection point, and this attack is unprecedented,” Ari Redbord of blockchain analysis firm TRM Labs told Bloomberg.
Redbord said North Korea had stolen roughly as much in a single evening as it had taken over the previous six years combined. Bloomberg also pointed to an April report from TRM Labs, which described recent attacks involving weeks of targeted manipulation.
Researchers suggested that AI may have helped the attackers, alongside face-to-face meetings with their targets.
The scale of North Korea-linked crypto thefts has already drawn attention this year. In the first four months of 2026, groups associated with the country accounted for around 76% of cryptocurrency hack losses, crypto.news reported, citing TRM Labs.
Much of the damage came from two attacks in April, targeting KelpDAO and Drift Protocol, which resulted in losses of around $600m combined.
Other North Korean hacking groups have also been experimenting with AI. In August, South Korean cybersecurity firm Genians reported that the Kimsuky group was using its own AI tools to generate malware and phishing messages.
While the extent of AI’s role in the Binance theft remains unclear, security researchers are increasingly concerned that these tools could make targeted attacks easier to organise and harder to detect.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
