North Korea’s Hackers Turn to AI as Record $6.3 Billion Binance Theft Rocks Crypto World

Image: Collected

North Korean state-backed hacking groups have made artificial intelligence a core part of their cyber operations, according to a new Microsoft Threat Intelligence report — a warning that comes just as the world’s largest cryptocurrency theft was linked to Pyongyang.

Microsoft said three North Korean hacking groups — Jade Sleet, Coral Sleet and Jasper Sleet — have reached its highest level of AI adoption, called “operationalized,” meaning generative AI is now used in their day-to-day attack work. Microsoft rates overall AI adoption among North Korean threat actors as high.

The report, published Oct. 29, placed eight North Korean groups on a four-stage scale. Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet were rated “accelerating,” while Emerald Sleet was rated “expanding.” No group remained at the lowest “emerging” stage.

How the hackers use AI

Microsoft said the groups use AI to speed up research, craft convincing phishing lures, build fake online identities and write malicious code.

Jade Sleet reportedly used AI for research and outreach while posing as recruiters for a fake AI blockchain company in June. Since April, Coral Sleet has planted malicious code in private GitHub repositories, which Microsoft believes was likely created with AI coding tools such as Cursor. Jasper Sleet uses AI to create fake personas and résumés so North Korean IT workers can obtain remote jobs under false identities.

Microsoft also found that Onyx Sleet produced more than 100 tailored PDF phishing documents targeting South Korean users in August and September — sometimes dozens within minutes. Since late October, Onyx Sleet and Pearl Sleet have used ARTEX, an open-source AI-powered penetration-testing tool, in live operations.

Despite the growing role of AI, Microsoft stressed that the operations “remain human-directed and have not become fully autonomous.” It also said AI’s effect on attack success rates remains unclear.

Record crypto heist linked to North Korea

The report was released the same day hackers stole roughly $6.3 billion from cryptocurrency exchange Binance, in what analysts are calling the largest theft in crypto history.

Blockchain intelligence firm TRM Labs said the attacker moved about $6.36 billion from Binance wallets across 10 blockchains beginning at 4:05 p.m. EDT on Oct. 29, with most of the funds drained within 20 minutes.

“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence,” the firm said, adding that it made the assessment “with high confidence.”

Chainalysis reached the same conclusion. Binance said the breach stemmed from a compromised DevOps laptop but did not name those responsible.

U.S. authorities previously blamed TraderTraitor for the $1.5 billion Bybit theft in February 2025, which had been the previous record.

A state funded by cybercrime

The Financial Times describes North Korea as a cash-strapped, sanctions-hit state that has invested heavily in cyber warfare to help finance itself. Microsoft said the groups’ goals remain unchanged: generating revenue for the regime and gathering intelligence.

AI, Microsoft said, acts as a “force multiplier” — allowing North Korean hackers to do more, faster, with methods they already know well.

For the crypto industry and global businesses, the message is stark: the world’s most prolific state-backed hackers are now using the same AI tools that companies use to boost productivity and by extension, to steal from them.