Binance Hackers Used AI to Hunt High-Value Crypto Targets, Bloomberg Reports

The hackers accused of the largest cryptocurrency theft on record appear to have used AI to help find targets, according to a Bloomberg report published Monday, November 2. For high-risk PSPs and exchanges, the useful part is not the headline number alone, but the method: the group is said to focus on infrastructure, fund flows, and automation, not retail-scale theft.

1. Bloomberg says the group behind the Binance hack is a North Korea-linked, state-sponsored team known as TraderTraitor, with only around a dozen members. The FBI has accused the group of the $6.3 billion hack last week on Binance, which Bloomberg describes as the largest cryptocurrency theft on record.
2. Instead of going after individual investors, the group reportedly uses a Big Game Hunting approach: it targets crypto-related businesses, maps their infrastructure, and then tampers with systems or fund transfer processes to pull off large-scale theft. Park Seong-su, staff threat researcher at Zscaler, told Bloomberg that AI has lowered the barrier to the skills needed for this kind of operation and increased the speed at which it can be executed.
3. Nick Carlsen, senior investigator for TRM Labs, told Bloomberg that the newer techniques used by TraderTraitor suggest the group has turned to AI for recent hacks. Bloomberg also noted that the group’s previous largest hack was the $1.5 billion theft from the Bybit exchange last year.
4. Elliptic Chief Scientist and Co-Founder Dr. Tom Robinson said the laundering of the proceeds is “highly complex and clearly automated.” In under four days, he wrote, the operation used about 12,000 wallets across 11 blockchains, roughly one new wallet every 25 seconds, and more than 40,000 transactions.
5. Robinson said most of the funds are still likely being held by North Korea, while the portion already being laundered may have passed through Chinese money laundering networks, which North Korea has used before. Separately, Chris Dimitriadis, chief global strategy officer at ISACA, said the financial exposure created by the hack is a board-level issue, not just a security-team issue.