North Korea's Hackers Deploy their Own 'Rogue' AI's to Hunt For Their Next Targets...
The group behind the biggest crypto heist in history is not done, and it is getting better at its job. The FBI blames North Korea's TraderTraitor unit for the $6.3 billion theft from Binance on October 29, and a new report from Bloomberg says the group is now using artificial intelligence to pick its targets. The unit may have only around a dozen members, according to experts cited in the report, but it hunts what cybersecurity researchers call "big game": large crypto companies with deep wallets, not individual investors. Its previous record was the $1.5 billion Bybit theft in 2025, and the Binance job smashed that record in about 20 minutes.
TraderTraitor does not break in through the front door. It studies a target company, learns how its systems and payment flows work, and then goes after the people who hold the keys. The group is known for approaching employees with access to sensitive systems and luring them with lucrative fake job offers, a tactic that ends with a compromised laptop or a clicked link. Binance has said its own initial investigation found a compromised laptop belonging to an engineer as the point of breach. Nick Carlsen, a senior investigator at TRM Labs, told Bloomberg that novel techniques used by the group suggest it is making ample use of AI in its recent hacks, and Park Seong-su, a threat researcher at Zscaler, said the new tools have lowered the barriers to carrying out advanced operations while speeding them up tremendously. Carlsen added a detail worth remembering: for all the talk of AI, the group's bread and butter is still the human part.
The scale of the operation is hard to overstate - North Korea is believed to be responsible for 89 percent of reported crypto hack losses in 2026
That's according to Chainalysis figures cited by Bloomberg, and the $6.36 billion taken from Binance is worth nearly 20 percent of North Korea's estimated annual economic output. United Nations experts said in 2024 that the country's cyber thefts and illicit financial activity could be funding about 40 percent of its banned weapons programs. Crypto has now overtaken the old revenue streams. Where Pyongyang once smuggled cigarettes and forged dollar bills, its hackers now bring in billions in pure profit from a single successful heist, and the money is increasingly flowing into conventional military spending as well, from new naval vessels to drone technology.
But the full story may be more complicated, because while Bloomberg's sources say AI is helping TraderTraitor find and compromise its targets, blockchain analytics firm Elliptic says it has found no evidence that AI directed the laundering of the stolen Binance funds. The laundering was automated, with about 20 automated services moving the money through decentralized exchanges, lending protocols and cross-chain bridges in less than three days, but Elliptic co-founder Tom Robinson said the pattern fits scripts written and supervised by people, not an AI agent making its own decisions. The numbers behind the cleanup are still staggering. In under four days the hackers used about 12,000 wallets across 11 blockchains, roughly one new wallet every 25 seconds, and more than 40,000 transactions. About $2.85 billion, or 44 percent of the stolen funds, has been frozen or seized, while the hackers still control about $3.28 billion spread across more than 950 wallets. Elliptic also found about $16 million sent to addresses holding proceeds from September's Bitget exploit, which suggests the same laundering operation is handling funds from more than one attack.
For anyone holding crypto on an exchange, the lesson is uncomfortably simple. Your money is only as safe as the least careful employee with access to the systems that move it, and the people trying to find that employee now have AI helping them search. Exchanges are beefing up security around staff with key access, but TraderTraitor has already shown it can get past the defenses of the biggest exchange in the world. Self-custody is not a slogan here, it is the one defense that does not depend on a stranger's laptop staying clean.
The AI angle is real, but it is worth keeping it in proportion. The evidence so far says AI helped the hackers choose and reach their target, while the laundering that followed looks like old-fashioned automation run by human hands. That distinction matters less than it sounds, because either way the group is faster, richer and harder to stop than it was a year ago, and it has now shown it can take $6.3 billion from the largest exchange on earth in less time than a lunch break. The next target is probably already being picked.
-------
Author: Ren Nakamura, Asia Newsroom, GlobalCryptoPress | Breaking Crypto News




















