North Korean state-linked hackers are escalating their cyber operations by integrating artificial intelligence, reinforcing their position as the dominant force behind cryptocurrency theft. A new report from blockchain intelligence firm TRM Labs reveals that North Korea-linked groups were responsible for approximately $643 million in stolen crypto during the first half of 2026, representing 66% of all hacking losses globally. In the same period, the cryptocurrency industry suffered $972 million in losses across 207 incidents, highlighting a stark concentration of damage in DPRK-attributed attacks.
The threat is evolving as cyber group Kimsuky, tied to North Korea’s Reconnaissance General Bureau, begins weaponizing generative AI. Cybersecurity firm Genians discovered that the group has deployed local large language models (LLMs) and AI tools—including Ollama, GPT4All, Msty, and Cursor AI—alongside retrieval-augmented generation (RAG) technology. By setting up a local LLM environment and an AI-assisted development setup, Kimsuky is moving beyond simple phishing toward automated, highly convincing social engineering campaigns.
Genians found evidence that the hackers used AI-generated documents mimicking legitimate corporate and financial materials to deceive targets. The attack chain typically begins with a malicious ZIP archive delivered via email, luring victims with decoy icons and filenames disguised as official research, honorarium requests, or embassy correspondence. The enclosed LNK shortcut then triggers code concealed through Base64 encoding and custom decoding routines—code often written with the help of the Cursor AI coding tool.
“This analysis shows that a nation-backed hacking group is advancing its attack capabilities by building local LLMs and AI development environments to integrate AI into actual attack frameworks,” said Moon Jong-hyun, head of the Genians Security Center.
The financial scale of DPRK’s crypto theft remains staggering. In 2025, North Korean hackers stole $2.06 billion, accounting for 60% of total annual theft, including the record-breaking $1.5 billion Bybit hack. From 2016 to 2026, CertiK estimates that North Korea has plundered $6.75 billion across 263 logged incidents. Social engineering remains the cornerstone of these operations, and the adoption of AI is expected to intensify that risk. CertiK warns that 2026 could see more AI-driven attacks, targeting of IT workers, and novel laundering methods, urging organizations to implement zero-trust policies, liveness-verified video interviews, and rigorous security training.
