North Korean Hacking Group Kimsuky Deploys AI in Crypto-Focused Attacks

North Korea’s state linked hacking group Kimsuky is incorporating artificial intelligence into its cyberattack operations targeting cryptocurrency and financial firms, according to a new report from South Korean cybersecurity firm Genians.

Researchers found the group has built three separate offline large language model environments using open-source tools, allowing hackers to operate without sending data to external cloud services and enabling more advanced query capabilities during attacks.

AI-Generated Phishing Grows More Convincing

Beyond building AI infrastructure, Kimsuky has also gathered coding assistants and speech-to-text tools to embed language models directly into malware development and attack automation. Researchers noted the group continues producing polished phishing documents themed around digital assets and investment platforms, with some materials closely mimicking legitimate Korean fintech content through natural language and professional formatting typical of AI-generated material.

Part of a Broader Pattern of Crypto Theft

North Korean hackers stole over $2 billion in cryptocurrency last year alone, including one of the largest exchange hacks on record. Security experts warn that AI is increasingly helping hackers uncover software vulnerabilities faster than defenders can patch them, with a recent major hardware wallet exploit suspected to have stemmed from a flaw AI helped identify.