.png){kind=logo}
North Korean hackers have expanded their cryptocurrency theft operations as security researchers warn that artificial intelligence may help them target major exchanges. According to cybersecurity experts cited by Bloomberg, the state-linked TraderTraitor group focuses on high-value crypto businesses rather than individual investors. The USD 6.3 billion Binance theft renewed scrutiny of its methods.
TraderTraitor follows a strategy security researchers call “big game hunting.” Its members study how cryptocurrency firms operate and search for employees who can access sensitive systems. Its methods include false job offers and attempts to compromise employee devices.
Park Seong-su, a threat researcher at Zscaler, told Bloomberg that the group seeks large payouts by learning about a target's technology and payment systems. Investigators have also linked TraderTraitor to the USD 1.5 billion Bybit theft in 2025.
Researchers suspect the hackers increasingly use AI tools to speed up parts of their work. Park said AI has lowered the barriers to carrying out advanced cyber operations. However, investigators have not publicly established which AI tools, if any, TraderTraitor used in the Binance attack.
Nick Carlsen, a senior investigator at TRM Labs, pointed to the group's use of social engineering. He said attackers can approach employees with attractive employment offers before trying to gain access to company systems. “Their bread and butter is the human part,” Carlsen said.
The FBI attributed the October 29 Binance theft to North Korea's TraderTraitor operation in an October 31 alert. The agency said attackers stole more than USD 6 billion in cryptocurrency. TRM Labs and Chainalysis had reached similar assessments.
Binance initially reported that a compromised engineer's laptop may have allowed unauthorized withdrawals. Co-CEO Richard Teng later said the company's investigation had found additional points of breach. The full sequence of events remains under investigation.
The FBI said the attackers were converting stolen assets mainly into Ethereum. It warned that the funds could move through decentralized finance platforms and services that exchange cryptocurrencies rapidly. The agency asked firms handling digital assets to block transactions connected to addresses linked to the theft.
Binance said it had replaced about USD 6 billion of the affected assets using company funds and other reserves by October 31. The company also reported that it and industry partners had located around USD 3 billion in affected assets for freezing efforts.
North Korea-linked attacks accounted for an estimated 89% of reported cryptocurrency hacking losses in 2026, according to Chainalysis figures cited by regional media. The estimate measures stolen asset values, not the money North Korea ultimately receives.
Cybersecurity researchers say North Korea recruits technically skilled students and trains some for government-backed hacking operations. Authorities have also linked the country to earlier attacks on cryptocurrency exchanges and other financial targets. Pyongyang has repeatedly denied accusations that it sponsors cybercrime.
United Nations experts estimated in 2024 that illicit cyber activity could finance around 40% of North Korea's weapons programs. That estimate does not establish how much of the recent Binance theft, if any, will reach military accounts.
Analysts say freezing stolen assets and tracing transfers may limit the funds available to the attackers. The FBI continues asking cryptocurrency businesses to identify and block wallets connected to TraderTraitor.
ALSO READ: Crypto Prices Today: Bitcoin Climbs Near USD 78,500 as Binance Restores Withdrawals