Experts say North Korea’s Binance hackers are using AI

The FBI has blamed TraderTraitor, an elite North Korean hacking unit, for the $6.3 billion theft from Binance. The heist is the largest in cryptocurrency history. On Nov. 2, Bloomberg reported that cybersecurity experts believe the group is now using artificial intelligence to find and break into high-value targets. In its Oct. 31 alert, the bureau said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026".bloomberg.com+1

How the theft unfolded

TRM Labs said the attacker moved about $6.36 billion out of Binance wallets on 10 blockchains, most of it in about 20 minutes. Binance said an engineer's laptop had been compromised and later reported "additional points of breach". The FBI, working with the Secret Service and IRS Criminal Investigation, said the hackers were converting the stolen funds mainly into Ethereum ↗ 6.74%. It also published more than 600 wallet addresses linked to the theft. Binance said it has replaced about 90% of the stolen amount and resumed withdrawals. The FBI has linked TraderTraitor to the $1.5 billion Bybit hack in February 2025 as well.cbc.ca+5

AI and "big game hunting"

Experts quoted by Bloomberg say TraderTraitor may have only a dozen or so members. They say the group uses AI to help seek out high-value crypto businesses to compromise, a strategy known as "big game hunting." "With new AI tools, the barriers to such skills have dropped significantly, while the speed at which these operations can be carried out has increased tremendously," said Park Seong-su, a researcher at Zscaler ↘ 0.29%. Nick Carlsen of TRM Labs said new techniques suggest the group is making heavy use of AI. However, AI's role in the Binance attack has not been confirmed, and Bloomberg presents it as the experts' assessment. Experts believe the AI is mainly used for reconnaissance and for crafting targeted phishing. President Donald Trump warned that "the bloodbath of AI hacking is to come".claimsjournal.com+3

Pyongyang's cyber army

South Korea's military estimated that North Korea had about 8,400 cyber personnel as of 2024, up 20% in two years, according to SBS. North Korea has not responded to the FBI's attribution. Lim Jong-in of Korea University told SBS that the North "trains 100 top-tier hackers every year." Chainalysis attributes 89% of reported crypto hack losses in 2026 to North Korea. TRM Labs' Ari Redbord summed up the scale of the theft. "In one evening, North Korea took around what they stole over the previous six years combined," he said.news.sbs.co.kr+2