Artificial intelligence may be helping North Korean hackers select crypto businesses for major thefts, researchers told Bloomberg, sharpening attention on a cyber revenue stream linked to the country’s military programs.
Nick Carlsen, senior investigator at TRM Labs, told Bloomberg that techniques in TraderTraitor’s recent operations point to extensive AI use. Park Seong-su, staff threat researcher at Zscaler, said the technology can reduce the expertise required and shorten the time needed to carry out cyber operations.
Park said the group examines crypto firms to understand where their systems or transfer processes may be exposed. Carlsen described a parallel effort to reach employees with sensitive access through social engineering, including job offers. Binance said an engineer’s compromised laptop figured in its initial review of the breach.
TRM Labs linked the Binance theft to TraderTraitor in an earlier EconoTimes report. Bloomberg reported that about $2.8 billion was frozen after hackers stole $6.36 billion in crypto over 20 minutes, leaving net outflows of $3.6 billion.
Chainalysis data put North Korean hackers’ share at 89% of reported crypto hack losses in 2026. United Nations experts said in 2024 that cyber theft and other illicit financial activity could finance about 40% of North Korea’s weapons of mass destruction programs.
Bloomberg reported that North Korea has a hacker force numbering in the thousands, while experts estimate TraderTraitor itself may have only about a dozen members. It said the country’s hacking teams draw on early selection and training at specialized institutions, including Moranbong College in Pyongyang, according to defectors and experts.
Bloomberg said crypto proceeds have grown more significant than other North Korean income sources, including trade with China and military ties with Russia. It also reported that TraderTraitor’s previous largest theft was the $1.5 billion Bybit hack in 2025; EconoTimes previously covered the FBI’s attribution of that theft to North Korea.
