North Korean hackers harness AI for cyber theft to fund nuclear weapons

A North Korean hacking group is suspected of stealing about US$6.3 billion (S$8 billion) in crypto assets from Binance, the world’s largest cryptocurrency exchange, and splitting the proceeds across 1,113 transfers within three days in an attempt to conceal the money trail. The stolen bitcoins alone were worth three times North Korea’s total merchandise exports last year.

Analysts say North Korea is combining elite hackers with artificial intelligence (AI) technology to turn crypto asset theft into a major source of funding for nuclear missile development, as international sanctions continue to restrict its foreign exchange earnings.

Cryptocurrency news outlets CoinDesk and Cointelegraph reported on Sunday (1 November) that Binance suffered a large-scale cyberattack on 29 October, with 18,270 bitcoins stolen. At about US$78,500 each, the stolen bitcoins were worth roughly US$1.4 billion. The number stolen was about 59% more than the 11,509 bitcoins held by US electric vehicle giant Tesla.

According to the Korea Trade-Investment Promotion Agency (KOTRA), North Korea’s merchandise exports totalled only about US$468.59 million last year, equivalent to a third of the value of the stolen bitcoins.

The US Federal Bureau of Investigation (FBI) said on 31 October that North Korean hacking group TraderTraitor was suspected of orchestrating the attack.

UK blockchain analytics firm Elliptic disclosed that, after stealing the crypto assets from Binance, the North Korean hackers split the proceeds across 1,113 transfers at average intervals of about 90 seconds. They dispersed the stolen funds across different wallet addresses, in an attempt to evade blockchain monitoring and fraud detection systems (FDS), making the funds harder to trace and freeze.

In some transactions, they were even willing to absorb conversion losses of up to 26% to conceal the money trail.

The incident once again highlights the cyberwarfare apparatus North Korea has built up over the years.

South Korean intelligence agencies estimated that North Korea had about 8,400 hackers in 2024, but security industry experts and academics believe the number of personnel involved may now exceed 10,000.

North Korea is understood to select pupils who excel in mathematics and science as early as primary school, sending them to schools such as Kumsong No. 1 and No. 2 secondary schools for programming training before they pursue further studies at Kim Chaek University of Technology and Kim Il Sung University. Some graduates are then assigned to agencies such as the Reconnaissance General Bureau to carry out cyberattacks.

The US Treasury Department placed North Korea-linked hacking groups Lazarus, Andariel and Bluenoroff on its sanctions list as early as 2019.

Advances in AI technology in recent years have further enhanced North Korea’s cyberattack capabilities. In an assessment on 29 October, Microsoft said that, of the eight North Korean hacking groups it was tracking, three had integrated AI into their day-to-day operations, while four others were rapidly expanding their use of the technology.

Some hackers use AI to create decoy documents tailored to specific targets, or approach employees of cybersecurity and blockchain companies with fake job offers to steal system access credentials.

According to US blockchain analytics firm Chainalysis, North Korea-linked cyberattacks accounted for only 15% of global losses from crypto asset theft in 2015. By 2026, that share had surged to about 89%, highlighting North Korea’s sharply increased role in global crypto asset theft.

Analysts note that the UN has long sought to cut off funding for North Korea’s nuclear missile development through measures including export restrictions, the repatriation of overseas workers and asset freezes. But the ease of transferring crypto assets across borders and the complexity of transaction routes have given Pyongyang a new way to circumvent financial sanctions.

Lim Eul-chul, a professor at Kyungnam University’s Institute for Far Eastern Studies, said cyberattacks are cheap to carry out and generate quick returns, undermining the effectiveness of international sanctions. For Kim Jong Un’s regime, crypto asset theft has evolved from an illegal means of plugging foreign exchange shortfalls into a “national strategic asset” that supports weapons development and the running of the regime.

As North Korea accelerates its use of AI technology, tracing and freezing illicit crypto assets will pose a new challenge for international efforts to cut off funding for its nuclear weapons.