Key highlights:
- North Korean hacking groups are using local LLMs to automate phishing attacks targeting Bitcoin
- The hackers are forging cryptocurrency-themed documents to fool unsuspecting victims
- Amid the wave of attacks, the Bitcoin ecosystem is staging a spirited defence to protect user funds
Emerging reports say the dreaded North Korean hacking syndicate Kimsuky has built a suite of artificial intelligence (AI) tools to automate cyberattacks targeting
“This analysis is a case showing that a state-backed hacking organization is building even a local LLM and AI development environment to integrate AI into an actual attack system and is advancing its attack capabilities,” said Moon Jong-hyun, head of Genians Security Center.
Kimsuky leaned on Ollama, GPT4All, and Msty to set up its custom AI environment. Furthermore, Genians found traces of AI coding assistant Cursor, AI agent development frameworks, and speech-to-text software in Kimsuky’s latest attack.
Particularly, the South Korean cybersecurity outfit noted that Kimsuky used the tools to generate fake cryptocurrency-themed documents designed to gain access to several Bitcoin projects. Genians noted that Kimsuky is using the AI-generated documents as spearphishing lures in the virtual assets and finance sectors.
While using fake documents to build user trust and induce execution of malicious files is not new, Kimsuky is recording a streak of successes given its use of “natural writing and a high level of completeness.” Between 2016 and 2026, North Korean hackers have stolen $6.75 billion worth of cryptocurrencies, leaning on AI-driven phishing tactics.
Security teams race to protect Bitcoin from bad actors
As bad actors turn to AI to scale their attacks against Bitcoin and other cryptocurrency projects, security teams are mounting an ecosystem-wide defence. Last week, the Bitcoin Red Team, a volunteer initiative, identified 85 critical security bugs across 390 projects in the Bitcoin ecosystem.
The team, leaning on AI to find the bugs, has drawn support from the Bitcoin community. At press time, the team has grown to 25 Bitcoin developers “working on the task non-stop for 108 hours.”
The Bitcoin Red Team’s effort comes on the heels of a jarring attack on Coldcard wallets that led to the loss of over $100 million worth of BTC. To minimize losses, a group of white hat hackers began draining vulnerable wallets, teeing up a two-horse race between bad actors and the ethical hackers.
Source:: North Korean Hackers Build Custom AI Tools To Target Bitcoin and Other Cryptocurrencies