North Korean hackers may be using artificial intelligence to plan and execute cryptocurrency thefts, raising fresh concerns about the growing threat of AI-powered cybercrime in the digital asset industry.
Security experts cited in a Bloomberg report published on Monday said the increasing sophistication and precision of recent cyberattacks suggested that hackers could be using AI tools to identify targets, exploit security weaknesses and gain access to sensitive systems.
However, the alleged use of artificial intelligence has not been independently confirmed.
The warning follows an alert issued by the Federal Bureau of Investigation on Saturday, which attributed the theft of more than $6bn in digital assets from Binance, the world’s largest cryptocurrency exchange, to North Korea.
The FBI identified the hacking group behind the attack as TraderTraitor, which it has also linked to the $1.5bn cryptocurrency theft from Bybit in February 2025.
Binance estimates its losses from the latest attack at approximately $6.3bn. Bloomberg reported that investigators believe the hackers gained access to a software engineer’s laptop, enabling them to infiltrate systems responsible for processing cryptocurrency withdrawals.
Federico Charosky of cybersecurity firm Quorum Cyber told Bloomberg that one tactic used by hackers involves targeting cryptocurrency exchange engineers with fake job interview offers.
During these interviews, victims are persuaded to install malicious software, giving attackers access to their devices and potentially the wider corporate network.
The experts believe AI tools could make such operations more effective by helping hackers research potential targets, identify vulnerabilities and develop convincing methods of deceiving employees.
“This is an inflection point, and this attack is unprecedented,” Ari Redbord of blockchain analysis firm TRM Labs stated.
Redbord said North Korea stole roughly as much cryptocurrency in a single evening as it had taken over the previous six years combined.
The report also cited an April report by blockchain intelligence firm TRM Labs, which detailed recent attacks involving weeks of targeted manipulation of victims.
Researchers suggested that artificial intelligence may have played a role in the operations, alongside face-to-face meetings with targeted individuals.
