North Korea
2 items across 1 edition. First seen Mon 2 Nov, last seen Mon 2 Nov.
- The Record reported on 2 November that the FBI and US Secret Service alleged over the weekend that North Korea's TraderTraitor stole more than $6.3 billion from Binance, and that the FBI, Secret Service and IRS-CI urged exchanges and DeFi operators to "block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets." It says blockchain security experts put about $3 billion frozen so far.
- On the AI question, The Record quotes Elliptic co-founder Tom Robinson describing the laundering as "on autopilot", and reports it was likely automated with human oversight rather than run by an AI agent. Chainalysis senior investigator Pierce Vaughn told the outlet: "We find the automations TraderTraitor is using has procedures already in place."
- A Bloomberg piece the same day takes the opposite emphasis: it reports that cybersecurity experts say AI helps the group pursue a "Big Game Hunting" strategy of seeking out high-value crypto businesses. Zscaler's Park Seong-su says that with new AI tools "the barriers to such skills have dropped significantly, while the speed at which these operations can be carried out has increased tremendously", and TRM Labs' Nick Carlsen says novel techniques suggest the group is making ample use of AI in recent hacks, while adding of its social engineering: "Their bread and butter is the human part."
- Both AI claims are expert assessment, not forensic evidence that AI was used in the Binance intrusion itself, and the two accounts pull in different directions. Bloomberg reports hackers stole $6.36 billion in 20 minutes, "worth nearly 20% of North Korea's estimated annual economic output", with roughly $2.8 billion frozen leaving net outflows of $3.6 billion, and cites Chainalysis for North Korea being responsible for 89% of reported crypto hack losses this year. Those dollar and share figures come from the companies investigating the theft and are not independently verified.
- The Kyunghyang Shinmun reported on 2 November at 09:18 KST that the Korean security firm Genians found signs the Kimsuky group "had built an environment using a large language model (LLM) and retrieval-augmented generation (RAG)", which Genians described as an attempt to analyse stolen documents, extract information and automate attack duties.
- The paper reports that since late September "more than 68,000 cases of personal information have been leaked at seven financial institutions including banks", that authorities suspect the same attacker used AI tools for large-scale automated attacks, and that traces of the open-source AI penetration-testing tool Artex were found at attacker IP addresses. It adds that Microsoft reported the North Korea-linked Andariel group has been using Artex since late October, while cautioning that the timing makes linking Andariel to the bank attacks premature.
- It cites a Microsoft Threat Intelligence report of 29 October finding that "three out of eight North Korean hacking groups were assessed to have reached a stage where AI is integrated into routine attack duties", and quotes Microsoft that "AI-based operations of North Korea are still under human involvement and are not at a fully autonomous stage." StealthMole CTO Simon Choi told the Financial Times that "AI has given hackers wings."
- This is one outlet's aggregation; the Microsoft and Genians findings it rests on were published before this window, and the attacker behind the financial-sector leaks is unidentified. No evidence has emerged that AI was used in the Binance attack itself.