Author: Nancy, PANews

The world is entering an era of asymmetric warfare.

On the physical battlefield between the US and Iran, Iran is using low-cost drones, missiles, and maritime blockades to engage in a war of attrition, restraining US military resources at a relatively limited cost and exerting pressure on the global economy.

In the crypto world, AI is lowering the technical thresholds for cyberattacks, amplifying the efficiency and destructive capabilities of attackers. With limited resources, attackers can cause significant losses to large enterprises and complex systems.

11.8 Billion Dollars, a National-Level Hacking Legion

North Korean hackers frequently launch attacks, causing alarm in the crypto market. While some are busy reinforcing security defenses, others are exploring different paths. A developer recently designed a rather alternative verification mechanism in an attempt to prevent North Korean users from accessing a website on a psychological level. Unexpectedly, this security experiment with a prankish tone inadvertently attracted a real cyberattack.

From high-frequency keywords in security incidents to material for crypto community jokes, North Korean hackers are gradually becoming an unavoidable topic in the industry. Behind the jokes lies the deepening concern about cybersecurity risks in the market.

Data from Chainalysis shows that as of October 29, 2026, losses attributed to suspected North Korean hacking attacks accounted for nearly 89% of this year's reported crypto hacking losses, while this proportion was 15% in 2021. In terms of losses from single attacks, the average loss from suspected North Korean-related attacks has risen from $50.65 million in 2021 to about $185 million in 2026, approximately 3.7 times that of 2021.

As one of the countries long subject to international sanctions, North Korea finds it difficult to obtain foreign exchange and resources through normal international trade and financial activities. As a result, cyberattacks have gradually become an important means for it to acquire funds and bypass financial restrictions.

The hacking force of North Korea is not a group of technical experts fighting individually, but a highly organized national-level cyber operation system that has been built over the long term. From talent selection, elite education to military training, and then overseas infiltration and real-world operations, North Korea has established a relatively complete talent development and operational mechanism.

This mechanism resembles the pyramid selection of math olympiad participants. A small number of teenagers with outstanding logical thinking and mathematical talents are selected nationwide, while their political background and loyalty are also scrutinized. The talents selected can obtain concentrated educational resources, receiving long-term and systematic training in computer science, mathematics, and programming.

After completing domestic training, some individuals are also sent overseas to operate under identities such as students, IT professionals, or remote technicians, accumulating technical experience in real environments while learning the languages, cultures, and work habits of target countries to prepare for subsequent actions.

To attract and retain these technical talents, North Korea also offers special treatment, including exemptions from certain military service obligations, residency qualifications in the capital, housing, higher incomes, and better educational and medical resources. For a resource-limited country, these incentives are quite attractive. Hackers who possess scarce skills thus obtain a special social status, gradually becoming an emerging privileged group in North Korea.

Talent development is just the first step; the highly specialized organizational division of labor is the real trump card of North Korea's "keyboard warriors." Reconnaissance personnel are responsible for collecting global cyber intelligence and finding system vulnerabilities to filter targets for attack actions; operational personnel use identity camouflage, social engineering, and malware to implement infiltration, stealing funds and sensitive information; there are also personnel specifically responsible for fund transfer, money laundering, and asset liquidation, converting the proceeds of cyberattacks into disposable funds.

From target selection, technical infiltration to fund transfer, a seemingly simple cryptocurrency theft incident may be backed by a complete transnational operational chain. Lazarus Group, APT38, Kimsuky, and others are different North Korean-associated hacking organizations identified by external security agencies based on their attack targets, technical means, and behavioral characteristics.

According to analyst Darkfost's recent disclosure, with the occurrence of the attack on Binance, the total amount of funds stolen by the Lazarus organization has reached $11.87 billion. According to data from the Bank of Korea in 2025, this figure corresponds to 45% of North Korea's GDP and 35% of its Gross National Income (GNI). If this estimate holds, the proceeds from cyberattacks would no longer be mere illegal income but could become a significantly substantial source of funding within North Korea's economic system.

For North Korea, cyberattacks are both a strategic weapon and another avenue to circumvent financial blockades and acquire economic resources. A country that traditional financial systems find difficult to reach is using cyberspace to seek new methods of resource acquisition.

The Biggest Security Vulnerability Might Be the "Colleagues" Next to You

When attackers no longer attempt to break through firewalls head-on but choose to look for entry points from within the organization, attack costs are often lower, and their actions are more concealed. The traditional defense system that relies on security devices and network borders is facing new challenges.

North Korean hackers are taking this asymmetric attack method to the extreme. They impersonate IT professionals or job seekers through carefully fabricated resumes, forged passports, and identity information, actively contacting core employees such as developers and operations personnel in organizations.

To further reduce the other party's vigilance, attackers may even participate in real video interviews and provide fake social media accounts containing personal photos and daily updates to create a believable job seeker image. Once they pass through the recruitment process and enter the team, they may use their legitimate employee identities to remain hidden for a long time, gradually accessing internal systems, code repositories, and sensitive permissions, seeking further infiltration opportunities.

The Ketman project funded by the Ethereum Foundation recently identified 100 North Korean IT personnel infiltrated within Web3 organizations over six months. Security researcher Taylor Monahan from MetaMask also revealed that at least 40 DeFi protocols had employed North Korean IT personnel during their development, with a time span of up to seven years. These personnel entered Web3 teams using forged passports, visas, and carefully crafted resumes. More confusingly, some of their blockchain development experience is genuine.

According to the latest disclosures from Binance, this year, the platform has intercepted 57 suspected North Korean-related cyberattacks. Attack methods include infiltrating through fake job interviews, using malware disguised as common developer tools, tampering with software packages and browser plugins, and inducing employees to run malicious programs through counterfeit video conferencing applications—all while stealing credentials and implanting remote access Trojans through social engineering attacks.

In this attack on Binance, which involved the theft of over $6 billion, according to initial investigative information disclosed by the authorities, the attackers contacted a software engineer from Binance's wallet infrastructure team through false high-salary recruitment invitations. After multiple rounds of video interviews, the attackers induced the engineer to run malware disguised as a technical test project on their work computer, ultimately controlling the employee's device and further threatening the security of the wallet infrastructure. Xuanshijun's founder, Yu Xuan, pointed out that such events belong to advanced persistent threats (APT), involving manipulation of human psychology, intelligence reconnaissance, malware bypassing, trust chain exploitation, targeted lateral poisoning, cloud environment penetration, risk control circumvention, and 0-day vulnerabilities among multiple aspects.

Similar tactics have occurred before. During the 2022 attack on Ronin Network, a subsidiary of Axie Infinity, the North Korean-related hacker group Lazarus Group also contacted a senior engineer at Sky Mavis via LinkedIn for a high-paying position. After multiple interviews, the attackers sent a false job invitation containing a Trojan virus, ultimately controlling systems related to validation nodes and stealing about $625 million in assets.

This is precisely the asymmetric security dilemma faced by the crypto industry. In the past, security defenses primarily relied on building robust technical barriers; however, as social engineering attacks continuously evolve, attackers do not necessarily need to master more advanced technologies or possess more resources, but simply find a weak link.

Compared to technical vulnerabilities, what truly poses a challenge to defense may be those who have already gained trust.

AI Upgrades the Cybersecurity Battlefield, Resource Competition Has Begun

If social engineering attacks have lowered the costs for hackers to breach organizational defenses, then the continuous iteration of AI has further amplified the scale and efficiency of cyberattacks.

A recent report from Microsoft's threat intelligence team indicates that among the eight major North Korean hacker organizations they are tracking, three have deeply integrated AI tools into their daily attack processes, achieving the highest level in Microsoft's AI applications maturity model.

In terms of social engineering and identity forgery, North Korean hacker organizations use AI to generate phishing, recruitment, and investment bait content in bulk, impersonating foreigners through translation and tonal adjustments, and even generating false resumes, interview answers, avatars, and voice videos. Among them, one organization generated over 100 customized phishing PDF documents targeting South Korean users between August and September 2026. North Korean remote IT personnel, employed under false identities in overseas companies, have also begun using AI to maintain multiple identities simultaneously.

According to South Korean security firm Genians, the North Korean hacking organization Kimsuky has built a local large language model (LLM) and RAG environment this August, leaving extensive records of using AI code editor Cursor. After interception of related tools, they can quickly switch tools to continue their activities.

Microsoft believes that these organizations have not yet achieved fully autonomous attacks, and the actual impact of AI on attack success rates and costs remains unclear. However, AI has already entered multiple stages of the attack process, from target reconnaissance, social engineering, to identity forgery and malware development. It may not directly transform ordinary attackers into top hackers, but it can compress the time and manpower needed to complete complex attacks.

In the Binance hacking incident, AI tools also became a part of the attack. According to investigative information, attackers provided engineers with tampered AI programming tools through supply chain attacks. Even if the engineers discovered anomalies and switched tools, their job information and that of other members of the wallet infrastructure team was already exposed. After controlling a computer of one engineer, the attackers used internal AI tools at Binance to further invade other employees' devices, ultimately gaining signature control.

As AI capabilities continue to grow, the competition in cyberattacks and defenses is also shifting from traditional technology and talent competition to the struggle for data, models, and computing resources, further exacerbating the asymmetry of cyber warfare.

Recently, security researcher Jun Song shared that an anonymous black hat organization contacted him, hoping to commission him to use vulnerability exploitation data to conduct reinforcement learning on a publicly available weight model and offered to pay an extremely high reward. Jun Song stated that the other party claimed the scale of the attack data they possessed was unprecedented, and even if someone told him it was an undercover dataset from a law enforcement agency, he would believe it. In contrast, he participated in a white hat project using GLM-5.3, where the data volume was less than 1% of what the other party claimed, yet the model's performance had already significantly surpassed cutting-edge models.

In the AI attack-defense competition, high-quality, large-scale vulnerability exploitation data may become an important resource for training cybersecurity models. Those who can obtain more data, stronger models, and more abundant computing power may gain an advantage in future attack-defense competitions.

If massive vulnerability exploitation data can be effectively transformed into model capabilities, attackers could further improve their vulnerability discovery and attack execution efficiency. Correspondingly, whether defenders can obtain sufficient data, models, and computing power will also affect their ability to identify and respond to new threats.

Coinbase disclosed in June that it had obtained access to the cutting-edge model Claude Mythos from Anthropic and used it to strengthen the security defenses of crypto wallets and assets. In contrast, Binance stated several months later that it had not yet obtained similar permissions. The differences in access to frontier models may further widen the capability gap between different enterprises regarding vulnerability discovery, automated security auditing, and risk defense.

From Iran using low-cost weapons to restrain US military power to North Korean hackers accelerating attacks through identity disguise, social engineering, and AI tools, although the battlefields are different, they point to a reality: resource advantages no longer mean absolute safety, and the real danger lies in using outdated thinking to confront new-era threats.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。