Group blamed for Binance hack ranks among North Korea’s top AI adopters, Microsoft says
- Microsoft Threat Intelligence says three North Korean hacking groups have embedded AI across their operations.
- Crypto exchanges and financial firms are North Korea’s primary targets.
- TraderTraitor is being blamed for the record $6.36 billion Binance theft.
Microsoft says three North Korean hacking groups now use AI in their daily attacks, the highest level on its scale.
Microsoft (NASDAQ: MSFT) rates North Korea’s overall use of AI in hacking as high. The report came out as North Korea is blamed for the biggest crypto theft ever, the $6.36 billion Binance hack.
How are North Korean hackers using AI?
In a report published Thursday, Microsoft Threat Intelligence ranked eight of North Korea’s most active hacking groups on a four-step scale. The steps are emerging, expanding, accelerating and operationalized. “Operationalized” is the top step and means that AI is part of the group’s whole operation.
Jade Sleet, Coral Sleet and Jasper Sleet are at the top step while Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are in the accelerating step. Emerald Sleet is in the expanding step and currently no group is in the emerging step.
Microsoft linked the rankings to specific activity.
- Jade Sleet ran campaigns through three fake companies in a single week.
- Coral Sleet found a way to plant malware in private code storage.
- Onyx Sleet created dozens of custom phishing messages within minutes.
- Diamond Sleet used AI to build fake people and front companies to trick its targets.
One group reportedly made over 100 custom PDF lures aimed at South Korean users in August and September. Work like this once took days for each target.
The groups also used AI coding tools. Microsoft said operators used tools such as Cursor to write code, fix errors and build ways to avoid detection.
Onyx Sleet and Pearl Sleet used ARTEX, an open-source tool that tests systems for weaknesses. It can be linked to an AI model and told to scout targets on its own. A China-linked group, Storm-0940, reportedly used ARTEX against ConnectWise.
Microsoft’s analysts believe humans are still mainly in charge of North Korea’s hacking operations and simply use AI to speed up work the groups already did, such as scouting targets, making phishing content and keeping fake identities going.
Microsoft said crypto exchanges and financial firms are among the most common targets for North Korea’s cyber operations because the aim is mainly to raise money for the regime and gather intelligence.
Did AI play a part in the Binance hack?
So far, there is no evidence yet that the attackers involved in the Binance hack used AI, and Microsoft’s report does not link the Binance theft to any AI technique.
The Binance hack, which has been described as the largest crypto theft on record, happened on October 29. Blockchain research firm TRM Labs said an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes.
TRM blamed TraderTraitor, which it calls North Korea’s elite hacking unit, and said it is highly confident in this finding. Jonathan Levin, co-founder of Chainalysis, reached the same conclusion on X.
Cryptopolitan reported that Binance’s own account of the incident outlines how the attackers got in, but not what tools they used. The exchange first said a hacked engineer’s laptop looked like the entry point, but a later probe found more “points of breach.”
Binance has frozen about $3 billion of the stolen funds, paused withdrawals and promised to cover user losses.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
Which North Korean groups did Microsoft name as its top AI adopters?
Microsoft Threat Intelligence named Jade Sleet, Coral Sleet, and Jasper Sleet as the three groups that have operationalized AI across their entire operations, the top tier of its four-stage scale.
How much was stolen from Binance, and who is blamed?
TRM Labs said about $6.36 billion was moved out of Binance wallets across ten blockchains, mostly within roughly 20 minutes, and attributed it with high confidence to North Korea's TraderTraitor unit, an assessment Chainalysis co-founder Jonathan Levin echoed.
Did North Korean hackers use AI in the Binance hack?
It is unconfirmed. Yonhap reported there is no evidence yet that AI was used in the Binance breach, and Microsoft's report does not tie the heist to any AI-assisted technique.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
