TL;DR:
Microsoft documented high adoption of artificial intelligence by state-sponsored cyber threat actors linked to the North Korean regime.
On-chain analytics firms such as TRM Labs attributed the $6.36 billion breach across ten blockchains suffered by Binance to the TraderTraitor unit.
Microsoft’s technical report does not link the use of AI tools to the direct execution of the exchange’s security breach.
A new Microsoft security report published on October 30 r evealed that North Korea-linked threat groups are increasingly leveraging AI models. This disclosure coincides with the ongoing investigation into the Binance hack that occurred on Thursday, October 29.
According to Microsoft’s analysis, multiple Pyongyang -linked cells have boosted the efficiency and speed of their social engineering campaigns through automation. The document identified that groups such as Onyx Sleet utilized generative tools to draft highly personalized phishing messages within minutes.
Meanwhile, the unit known as Diamond Sleet leveraged synthetic technologies to establish fraudulent identities and front companies aimed at deceiving industry professionals. Concurrently, Microsoft’s records attribute to the Coral Sleet collective the deployment of tailored malware targeting private code repositories.
The release of the report coincides with the fallout from the incident suffered by Binance during the final week of October 2026. In that attack, threat actors drained an estimated $6.36 billion from the entity’s hot wallets across ten blockchain networks in approximately 20 minutes.
Incident Attribution and Microsoft’s Technical Demarcation
Blockchain intelligence firm TRM Labs attributed the material execution of the attack to the North Korean unit TraderTraitor with high confidence. This assessment was corroborated by independent reports from analytics platforms Chainalysis and Pangolin Intelligence, based on matching patterns with historical transactions.
Nonetheless, technical documentation released by Microsoft establishes no causal link between AI-assisted tactics and the breach of the exchange’s systems. Reports from the South Korean news agency Yonhap reiterated that, to date, no conclusive evidence has emerged to confirm the involvement of AI models in the breach of the platform.
Binance announced via its corporate channels that its preliminary investigation identified the compromise of a laptop belonging to an engineer on its technical staff. The exchange’s CEO, Richard Teng , later clarified that the intrusion involved a complex architecture across multiple access points rather than an isolated single-user action.
According to Binance executives, the platform ruled out direct compromise or exposure of its wallet private keys. TRM Labs estimates indicate that security firms and the exchange managed to freeze nearly $3 billion in assets tied to the incident in the days immediately following the hack.
Historical cybersecurity records consistently rank exchanges and decentralized finance platforms as primary targets for North Korean cyber operations. Chainalysis data revealed that regime-linked groups stole roughly $2 billion in digital assets during 2025. The prior record for digital asset theft was held by the February 2025 intrusion targeting Bybit, estimated at $1.5 billion.
Binance leadership stated that an updated Proof of Reserves audit is slated for publication once the current forensic and regulatory reviews are finalized.
