North Korean hackers use AI to hunt high-value crypto targets, experts say

High-value cryptocurrency businesses are facing North Korean hackers who use AI to help choose their targets, cybersecurity experts told Bloomberg. The November 2 report describes TraderTraitor, a state-sponsored unit focused on large thefts rather than individual investors.

The stakes extend beyond identifying the next target. Bloomberg, in an article published by The Japan Times, says the FBI blames TraderTraitor for a recent $6.3 billion Binance hack.

Finding businesses worth attacking

Researchers call the unit’s approach “Big Game Hunting”: pursuing cryptocurrency companies capable of yielding a large payout, instead of stealing from investors one by one. Experts estimate that TraderTraitor may have only around a dozen members, despite operating within North Korea’s much larger, thousands-strong hacking force.

Park Seong-su, a staff threat researcher at Zscaler, described the attack method to Bloomberg. The group studies a crypto business’s infrastructure, then tampers with that infrastructure or its fund-transfer processes to carry out a large theft.

the barriers to such skills have dropped significantly, while the speed at which these operations can be carried out has increased tremendously

Park Seong-su, Zscaler staff threat researcher, speaking to Bloomberg; quoted by PYMNTS

Attack techniques underpin the AI assessment

Nick Carlsen, a senior investigator at TRM Labs, told Bloomberg that new techniques in TraderTraitor’s recent hacks indicate the group has turned to AI.

The group already had a record of major thefts. Bloomberg identified its previous largest hack as the $1.5 billion theft from the Bybit exchange the prior year, according to PYMNTS.

The money moves through thousands of wallets

PYMNTS also obtained an assessment of the laundering from Elliptic co-founder and chief scientist Tom Robinson. He described it as highly complex and clearly automated. In under four days, he said, the activity used about 12,000 wallets across 11 blockchains and more than 40,000 transactions—roughly one new wallet every 25 seconds.

Robinson said most of the funds were likely still held by North Korea. Funds already being laundered could be with Chinese money-laundering networks, which he said North Korea had used before.

The financial exposure also raises a question of who owns the response inside a company. Chris Dimitriadis, ISACA’s chief global strategy officer, told PYMNTS after the hack that oversight belongs in the boardroom, not solely with the security team. His argument treats a theft of this scale as a governance issue as well as a technical failure.