The hackers accused of carrying out the largest cryptocurrency theft on record may have had AI-powered assistance.
That’s according to a report Monday (Nov. 2) from Bloomberg News, which says these hackers are part of a state-sponsored group from North Korea trained from an early age to target “big game,” or high-value crypto companies.
Experts tell Bloomberg that the group, which the FBI has accused of the $6.3 billion hack last week on Binance, is known as “TraderTraitor” and may only have around a dozen members.
Instead of going after individual investors, the group uses a strategy known as Big Game Hunting, employing artificial intelligence (AI) to find their targets.
“This particular group looks for a big haul,” said Park Seong-su, staff threat researcher at the cybersecurity company Zscaler.
“They target crypto-related businesses, gain an understanding of their infrastructure and then tamper with it — or fund transfer processes — to execute a large-scale theft.”
With new advances in AI “the barriers to such skills have dropped significantly, while the speed at which these operations can be carried out has increased tremendously,” Park added.
Nick Carlsen, senior investigator for TRM Labs, told Bloomberg that new techniques being used by TraderTraitor indicate the group has turned to AI for its recent hacks. The group is also breaking new records in terms of revenue, Bloomberg noted, as its previous largest hack was the theft of $1.5 billion from the Bybit exchange last year.
Meanwhile, Elliptic Chief Scientist and Co-Founder Dr. Tom Robinson offered some insights Monday into how the hackers were laundering their proceeds.
“The laundering is highly complex and clearly automated,” he wrote in an analysis shared with PYMNTS. “In under four days it has used about 12,000 wallets across 11 blockchains, roughly one new wallet every 25 seconds, and more than 40,000 transactions.”
Robinson said most of the funds are still likely being held by North Korea, with those being laundered potentially already with Chinese money laundering networks, which North Korea has used in the past.
PYMNTS spoke with experts last week about the fallout from the hack, including Chris Dimitriadis, chief global strategy officer at ISACA. He said the financial exposure created by the hack demands board oversight.
“This is ultimately a governance question, and it belongs in the boardroom, not just the security team,” Dimitriadis said.
