Crypto holders and platforms face greater theft risks as artificial intelligence lowers the technical barriers to sophisticated attacks and speeds their execution, according to Park Sung-su, a threat researcher at Zscaler.
The FBI said TraderTraitor, a North Korean state-backed hacking group, was responsible for the theft of approximately $6.3 billion from Binance, the world’s largest cryptocurrency exchange. The group is using AI to expand the scale of its cryptocurrency thefts.
TraderTraitor’s approach begins with what investigators call Big Game Hunting: using AI to identify high-value crypto businesses and pursue them as targets.
The group then combines hacking skills with social engineering. It identifies employees with access to critical systems and persistently approaches them with lucrative job offers.
Binance’s initial investigation traced the breach to a compromised laptop belonging to an engineer.
At 4:20pm Eastern Time on the 29th of last month, funds began moving across 10 blockchains. Binance’s security team saw more than $1 billion drain away as the attack unfolded.
In about 20 minutes, the attackers siphoned $6.3 billion. Binance activated emergency measures to freeze assets and stop transfers.
About $2.8 billion was frozen afterwards, while net outflows reached $3.6 billion.
On the 31st of last month, the FBI announced that it had identified TraderTraitor as the perpetrator. The $6.3 billion haul is the largest cryptocurrency theft ever reported.
Nick Carlsen, a senior investigator at TRM Labs, said TraderTraitor’s recent methods show active use of AI. The implication is that a group thought to contain only a dozen or so members can concentrate its efforts on the people and systems that matter most inside a large exchange.
North Korea maintains a hacker army numbering in the thousands. Defectors and experts say students selected for hacking teams receive training at specialised institutions including Moranbong College in Pyongyang.
The Binance theft far exceeded TraderTraitor’s previous largest known operation, the $1.5 billion Bybit heist in 2025. Ari Redbord, TRM Labs’ global head of policy, said North Korea took in a single night an amount equal to everything it had stolen over the previous six years combined, and described the Binance case as the largest bank robbery in human history.
The $6.3 billion theft equals roughly one-fifth of North Korea’s annual economic output. A valuation of $6.36 billion puts the stolen amount at nearly 20% of the country’s estimated annual economic output.
Chainalysis estimates that North Korea is responsible for 89% of reported crypto hack losses this year. The revenues generated by TraderTraitor could fund nearly half of North Korea’s banned weapons programmes.
United Nations experts said in 2024 that North Korea’s cyber thefts and illicit financial activity could fund about 40% of its weapons of mass destruction programmes. Adam Farrar, a senior analyst at Bloomberg Economics and a former National Security Council director for Korean affairs, said North Korea appears to have sufficient money to support conventional military buildups, including spending on naval vessels and drone technology.
Comments (0)