The FBI has officially identified the North Korean hacking group TraderTraitor as responsible for a $6 billion theft from Binance, the world's largest cryptocurrency exchange. Experts warn that North Korea's hacking capabilities are increasingly integrating artificial intelligence (AI) and may soon target South Korea.
According to a report released by Microsoft Threat Intelligence on October 29, three of the eight North Korean hacking groups have reached the 'operational integration' stage of AI use in their routine attacks. Four groups are classified in the 'acceleration' stage, while one group has adopted AI for specific tasks.
One North Korean hacking group created over 100 customized PDF lure documents targeting various victims between August and September, with indications that dozens were produced within minutes. South Korea was among the primary targets.
From June 8 to 12, the group posed as three fake companies to offer fraudulent job opportunities to professionals in the AI, blockchain, and cybersecurity sectors. The North Korean reconnaissance agency's 'Onyx Slit' (known domestically as Andariel) and 'Pearl Slit' have been using the open-source AI penetration testing framework 'ARTEX' in actual operations since late October. This tool helps identify security vulnerabilities using AI.
CrowdStrike's '2026 Threat Hunting Report' indicates that the North Korean-linked 'Famous Chollima' was responsible for 55% of global hacking incidents attributed to state actors from July of last year to June of this year. According to blockchain analysis firm Chainalysis, North Korea stole $2.02 billion worth of cryptocurrency in 2025 alone, a 51% increase from the previous year, bringing the total amount stolen to $6.75 billion, which accounts for 59% of global thefts. Although the number of attacks decreased by 74% compared to the previous year, the scale of each attack has grown.
This year has seen an escalation. Chainalysis estimated on October 30 that approximately 89% of global cryptocurrency hacking losses this year were attributed to North Korea. Blockchain security firm BlockAid analyzed that of the $1.1 billion in global hacking losses in the first half of this year, $609 million, or 55%, was taken by TraderTraitor.
A notable case, the KelfDAO incident, involved deceiving developers to extract login information and implanting fake approval messages rather than breaching security systems. BlockAid predicts that North Korea will continue to deceive exchange employees to seize internal approval rights in the second half of the year. The recent Binance incident also targeted vulnerabilities in an engineer's laptop and the transaction approval system.
The primary target remains the financial sector. According to CrowdStrike's '2026 Financial Services Threat Environment Report,' the financial services sector moved from the sixth most attacked industry in the first quarter of last year to the fourth in the first quarter of this year. The number of internal infiltration operations using disguised North Korean IT personnel increased from 33 cases in March 2025 to 45 cases in March this year. CrowdStrike assesses that North Korea's operations targeting banks and financial institutions will intensify throughout the year.
Actual infiltration into South Korean companies has also been confirmed. Kaspersky released a report on 'Operation Flashhole,' revealing that the North Korean-linked Lazarus group sent fake resumes and portfolio site links via email to at least three organizations in the domestic software, construction, and telecommunications manufacturing sectors.
Evidence of the attacks dates back to July 2025, with indications that the widely used domestic security program 'CrossWeb EX' may have been involved in the infections. Websites of domestic academic societies, media outlets, and construction companies were also included in a list of indicators of compromise showing command and control (C2) communication addresses for malware. C2 refers to the communication base where attackers send commands to infected computers and receive information.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.