How North Korean Hacking Evolved: AI and Social Engineering Used to Target Binance

A North Korean state-backed hacking group known as TraderTraitor is using artificial intelligence to rapidly increase the scale of its cryptocurrency thefts, Bloomberg reported. The group is using AI to boost both the speed and sophistication of its attacks.

Bloomberg reported on Nov. 2 that the Federal Bureau of Investigation recently identified TraderTraitor as being behind the Binance hack. The group stole $6.36 billion worth of crypto in 20 minutes. About $2.8 billion was later frozen, leaving a net outflow of $3.6 billion. That is equal to roughly 20% of North Korea's annual economy.

Cybersecurity experts say TraderTraitor uses a "Big Game Hunting" strategy, selecting high-value crypto firms and focusing its attacks on them. Park Sung-su, a threat researcher at cybersecurity company Zscaler, said the group targets crypto-related companies in pursuit of large paydays, maps their infrastructure and then manipulates fund-transfer processes to carry out large-scale theft. The arrival of AI tools has sharply lowered the technical barriers for such attacks while dramatically accelerating how quickly they can be executed.

Nick Carlsen, a senior investigator at TRM Labs, said TraderTraitor's recent methods clearly show active use of AI. The group's core tactic, he said, is still people. It identifies employees with access to critical systems, then persistently approaches them with tactics such as high-paying job offers, combining social engineering with advanced hacking techniques. Binance said its initial investigation found that an engineer's laptop was the route of compromise.

According to blockchain analytics firm Chainalysis, North Korean hacking groups are estimated to account for 89% of reported crypto-hacking losses this year. Experts say the revenue they generate could support nearly half of North Korea's banned weapons programs. A United Nations panel of experts also said North Korea's proceeds from cyber theft in 2024 could cover about 40% of funding for its weapons of mass destruction programs.

Lim Eul-chul, a professor at Kyungnam University's Institute for Far Eastern Studies, said North Korea's crypto hacking has moved beyond simply making up for a shortage of foreign currency.

Adam Farrar, a senior analyst at Bloomberg Economics who served as the National Security Council's director for Korean affairs under the Trump and Biden administrations, said the country now appears to have enough money to support even conventional military buildups, including investment in naval vessels and drone technology.