North Korean hackers are increasingly using artificial intelligence to strengthen cyberattacks against cryptocurrency and financial companies, according to new cybersecurity research. The shift signals a broader evolution in how Pyongyang-linked groups combine social engineering, malware and automation to pursue digital assets.
The activity adds another layer of risk for crypto exchanges, fintech platforms and financial institutions. Security researchers say North Korean operators are no longer treating AI only as a tool for generating convincing phishing messages. Instead, they are integrating AI into multiple stages of their operations.
AI Expands the Attack Surface
Recent research found North Korean-linked groups using large language model platforms, AI coding tools and document-search technology during cyber operations. Researchers also identified AI-generated documents designed to resemble legitimate financial and cryptocurrency investment materials.
The technology can help attackers analyze information, create convincing communications and potentially accelerate malware development. Local AI systems can also reduce the need to send sensitive information to external services, making the activity harder to detect.
Furthermore, other recent investigations have linked North Korean operators to AI-generated identities and synthetic video environments used to target financial companies. These tactics can make fake recruiters, executives and business contacts appear more credible.
Crypto Remains a Major Target
The financial incentive remains significant. A major 2026 financial-sector threat report estimated that North Korea-linked actors stole about $2.02 billion in digital assets during 2025. That represented a 51% increase from the previous year.
Cryptocurrency companies face particular risks because employees often handle private keys, wallet infrastructure and high-value transactions. Attackers can exploit trusted relationships rather than directly attacking blockchain networks.
The latest developments suggest that AI could make those campaigns faster and more scalable. However, researchers have not established that AI alone is responsible for the attacks or that every reported capability has produced successful theft.
For crypto businesses, the threat reinforces the importance of stronger identity verification, employee security training and monitoring of unusual access. As North Korean operators continue adapting their methods, AI is becoming another tool in a long-running campaign focused on espionage and financial gain.
