North Korean Hacking Groups, Cryptocurrency Theft Surges 51%...AI Infiltration Fear Grips Exchanges and Fintech

▲ Lazarus, North Korean Hacker, Virtual Asset Hacking/AI Generated Image

North Korean-linked hacking groups increased the scale of cryptocurrency theft by 51% in 2025, emerging as a key variable in cyber threats targeting exchanges, fintech companies, and the financial sector.

According to BeInCrypto on May 15 (local time), CrowdStrike's 2026 Financial Services Threat Landscape Report revealed that North Korean-linked hackers stole $2.02 billion worth of cryptocurrency in 2025. This marks a 51% increase compared to 2024. The report stated that North Korean-related operations pose a significant threat to cryptocurrency and fintech companies, and the stolen funds are reportedly flowing into the North Korean regime's military programs.

The report analyzed that North Korean-linked cyber organizations more actively utilized artificial intelligence (AI) to expand their attacks on the financial sector. FAMOUS CHOLLIMA was found to have doubled the scale of its activities by using AI-generated identities to infiltrate cryptocurrency exchanges, fintech companies, and personal banks. STARDUST CHOLLIMA also targeted North American, European, and Asian fintech companies using AI-created recruiter profiles and manipulated video conferencing environments.

Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, said, “Financial services organizations are under threat from all directions, and AI is making all threats harder to defend against. The cost of creating plausible identities, automating reconnaissance, and accelerating credential theft is near zero.”

Ransomware and cyber espionage activities also increased pressure on the financial sector. CrowdStrike reported that 423 financial services victims were listed on dedicated leak sites during the reporting period, a 27% increase year-over-year. Global direct intrusion attacks increased by 43%, with a 48% surge in North America. The pressure continued into Q1 2026, with North America accounting for more than half of financial sector intrusion incidents.

The report explained that as of Q1 2026, the financial services industry accounted for 12% of all recorded activity, making it the fourth most frequently targeted sector. TRM Labs linked approximately $577 million in stolen funds from Drift Protocol and KelpDAO by April to North Korean organizations. However, North Korea denied claims of cyber threats through the Korean Central News Agency (KCNA). The cryptocurrency industry has entered a new security phase, combining AI-driven identity impersonation, credential theft, and exchange infiltration.

*Disclaimer: This article is for investment reference only, and we are not responsible for investment losses based on it. The content should be interpreted for informational purposes only.*