North Korean state-linked hacking groups drove 66% of all crypto hack losses in the period covered by a new TRM Labs report. The blockchain analytics firm put the total stolen by these groups at approximately $643 million. That figure underscores the outsized role Pyongyang-backed operations continue to play in crypto theft worldwide.
TRM Labs singled out Kimsuky, a hacking unit long associated with North Korean state interests, as a central actor in this activity. According to the report, Kimsuky has begun integrating artificial intelligence tools into its operations. The group is targeting both cryptocurrency platforms and traditional finance infrastructure, the report states.
The use of AI marks an evolution in tactics for North Korean cyber units, which have historically relied on phishing, malware, and social engineering to breach exchanges and wallets. Incorporating AI can speed up reconnaissance, automate parts of an attack, and help hackers craft more convincing lures. Analysts have warned for months that AI tools lower the barrier to executing sophisticated attacks at scale.
North Korea has faced international sanctions for years, and its government has been repeatedly accused by security researchers and Western officials of using stolen crypto to fund state programs, including its weapons development. Blockchain analytics firms like TRM Labs have become key sources for tracking these flows, since North Korean-linked wallets and laundering networks often leave a traceable, if complex, path on public ledgers.
The $643 million figure attributed to North Korean actors represents a significant share of total crypto theft losses tracked in the period. It reinforces a pattern researchers have documented for several years: a small number of state-sponsored groups are responsible for a disproportionate share of the sector's largest heists. Exchanges, custodians, and decentralized finance platforms have all been targeted at various points.
The report arrives as the crypto industry continues to grapple with security gaps in custody, key management, and smart contract design. Even as institutional adoption grows and regulatory frameworks mature in some jurisdictions, security researchers say state-backed hacking groups remain a persistent threat. The addition of AI to their toolkit adds a new dimension to that risk.
Market Impact
The scale of losses attributed to North Korean hackers is likely to intensify pressure on exchanges and custodians to strengthen internal security protocols and threat detection systems. Firms handling large volumes of digital assets may face renewed scrutiny from regulators and insurers over how they defend against increasingly automated attack methods.
The report may also accelerate industry investment in AI-driven defensive tools, as security teams look to counter AI-enhanced offensive tactics with comparable technology. For investors and platforms alike, the findings serve as a reminder that custody risk remains a material factor in the broader crypto market structure conversation.
As North Korean hacking groups adopt AI to scale their operations, the crypto industry faces renewed pressure to close security gaps that have already cost hundreds of millions of dollars. The TRM Labs findings highlight how state-sponsored cybercrime continues to shape risk across the sector.
Frequently Asked Questions
What did TRM Labs report about North Korean hackers?
TRM Labs reported that North Korean state-linked hacking groups were responsible for 66% of tracked crypto hack losses, totaling roughly $643 million.
Which North Korean group was named in the report?
The report identified Kimsuky, a hacking unit linked to the North Korean state, as a key actor incorporating AI into its attacks.
How are North Korean hackers using AI in these attacks?
According to the report, Kimsuky is integrating AI tools into cyberattacks targeting both cryptocurrency platforms and traditional financial institutions, though specific methods were not detailed.
Why does North Korea target crypto platforms?
Researchers and officials have long linked North Korean cyber theft to efforts to fund state programs amid international sanctions, though this report focuses on tracked loss figures rather than motive.