From mass-personalized phishing to the compromise of transaction-signing systems, North Korean hacking groups have become more threatening through their use of AI
Whenever we encounter the damage caused by a hack, we first check how much money has disappeared. But what deserves more attention is how the methods of attack are changing. If artificial intelligence (AI) is reducing the time and effort required to prepare an attack, defense systems designed around the personnel and speed of the past may be rendered ineffective.
According to an analysis by Microsoft (MS), three of the eight North Korean hacking groups examined have reached the stage of integrating AI into their routine attack operations. Cases have also been identified in which large numbers of personalized PDF lures targeting South Korean users were produced. This suggests that future phishing may arrive not as awkward messages sent identically to everyone, but as natural-sounding proposals tailored to the recipient’s work and interests.
In the past, phishing emails could often be recognized by their unnatural wording and crude formatting. That is no longer a sufficient basis for trust simply because a message reads smoothly and fits the business context. Even with materials routinely exchanged in daily work—such as investment proposals, recruitment assignments, interview requests and collaboration documents—it is essential to develop the habit of separately verifying the sender and the delivery route.
The large-scale theft of crypto assets occurring day after day demonstrates the destructive power these threats can cause. Blockchain analytics firm TRM Labs recently analyzed that approximately $6.36 billion was drained from wallets related to Binance, with most of the fund movements occurring over roughly 20 minutes. It identified the North Korean hacking group “TraderTrader” as being behind it.
The concern related to this hacking incident is the increase in attack attempts. If attackers reduce the time they spend writing documents and modifying code, they gain room to contact more targets and quickly alter failed attempts. Companies and users defending themselves must therefore identify that many more suspicious approaches. Regardless of how much the attack success rate has increased, the burden of defense becomes far greater than before.
Exchanges must prevent a single breach from escalating into massive withdrawals
The first thing exchanges and crypto-asset companies should examine is the path from work accounts and devices to the authority to move assets. They must be designed so that even if an employee’s laptop or account is compromised, an attacker cannot immediately access core systems and transaction-signing authority.
To this end, access privileges for development and work environments should be separated from those for asset operations, and each person should receive only the scope and duration of access necessary for their role. Large withdrawals and important configuration changes should require independent approval procedures, and approvers must be able to verify the actual receiving address and transaction details. Even a structure in which multiple people approve can remain exposed to common vulnerabilities if it depends on the same devices or identical administrative privileges.
The amount of assets held in hot wallets and withdrawal limits must also be managed together. The goal of security does not end with preventing intrusion. It must also include limiting the scope and amount that an attacker can move if an intrusion occurs.
Detection, too, cannot rely solely on the title of a document or whether it matches known malware. Organizations must examine changes in actual behavior, such as administrator access that differs from normal patterns, sudden privilege changes, unusual signing requests and fund movements. They should also determine in advance who will halt withdrawals when an alert sounds and through what channels the relevant authorities and other operators will be notified.
The need for individual verification habits and coordinated response systems
Individual users must also raise their security standards. When receiving a message from an exchange or wallet service, it is preferable to verify it by accessing the official app or a directly saved address rather than clicking a link in the message. Even if a file is received for work, if it requests an unexpected login or program installation, the authenticity of the request should be confirmed through a separate contact channel already known to the recipient.
When storing crypto assets directly, it is important never to enter a recovery phrase online or provide it to anyone else. Even when using a hardware wallet, users remain responsible for confirming what they are approving. Exchange custody and self-custody each involve different risks, so the choice must take into account one’s ability to manage them.
The response from companies and governments must not remain confined within the boundaries of individual organizations. Addresses and domains used in attacks, along with indicators of compromise, should be shared rapidly, and emergency contact systems among exchanges, security firms and investigative authorities should be kept operational in ordinary times. At the same time, support should be provided so that partner companies lacking sufficient security personnel and budgets can also raise their level of defense.
In an era when AI is accelerating the preparation of attacks, we cannot expect every user to make a perfect judgment every time. We need authentication procedures that help users stay alert, permission structures that limit the consequences of a single mistake, and response systems that enable immediate suspension when signs of abnormal activity are detected.
If the crypto-asset industry is to preserve trust, it must not treat security as an auxiliary service feature. The task is not merely to warn that attackers have become more sophisticated, but to build structures capable of protecting users’ assets even when an actual breach occurs. That is the challenge the industry must answer in the wake of this Binance hacking incident.