‘North Korea as the culprit’ singled out by former FBI expert···“North Korea’s ability to detect hacking targets with AI is at a ‘superpower’ level” - 경향신문

This article was translated by an AI tool. Feedback Here.

“North Korean hackers’ ability to use artificial intelligence (AI) to identify potential attack targets is virtually at a ‘superpower’(superpower) level.”

Nick Carlsen, senior investigator at the private blockchain analytics firm ‘TRM Labs’, which was the first to identify and announce North Korea’s hack of the world’s largest virtual-asset exchange, Binance, said in a video interview with the Kyunghyang Shinmun on the 4th that North Korea’s hacking capabilities have further evolved due to AI. He said North Korean hacker groupsespecially ‘TraderTraitor’, named as the suspect in the Binance hack“have come to use highly sophisticated techniques for targeting (identifying targets),” adding, “North Korea already had strengths more in social engineering than in pure code-based attacks.” This means they carried out ‘social-engineering hacking’ that infiltrates systems by exploiting human error or psychological manipulation rather than only attacking technical system vulnerabilities.

Carlsen in particular predicted that “security vulnerabilities (CVEs) have increased by a factor of 23 due to AI and could rise even more steeply,” and that “it will be serious if Chinese open-source distilled modelseffectively built by stealing research from cutting-edge labsbecome more widely distributed.” Pointing to the risks of AI-driven advances in hacking capabilities, he added, “It is really hard to put the genie back in the bottle.”

Nick Carlsen, a former U.S. Federal Bureau of Investigation (FBI) investigator and senior investigator at ‘TRM Labs’, holds a video interview with the Kyunghyang Shinmun on the 4th. The private blockchain analytics firm TRM Labs was the first to reveal that, immediately after it occurred, the hack of the world’s largest virtual-asset exchange, Binance, was carried out by North Korea. Zoom screen capture

Carlsen worked at the Federal Bureau of Investigation (FBI) from 2009 to 2021, tracking North Korea’s illicit money laundering, and has since been tracking and analyzing North Korea’s theft of virtual assets through blockchain data analysis. Having studied North Korea’s sanctions-evasion tactics for nearly 20 years, he also assessed that North Korea’s theft of virtual assets is being carried out in connection with Chinese criminal organizations.

He said, “In the stage left of the theft, there are North Korean hackers, but after that, in the money-laundering phase, they subcontract to Chinese criminal organizations,” adding, “They typically pay subcontracted organizations 35 percent in fees at each laundering stage, and even if they pay 30% of the total (stolen assets), it is an enormous income for North Korea.” Even if the Reconnaissance General Bureau personnel managing North Korean hackers number in the hundreds, he predicted that the actual operators deployed in cyber operations “are probably a couple dozen.” Given a structure in which small elite outfits like TraderTraitor or Lazarus can steal hundreds of millions to tens of billions of dollars, he explained, North Korea is reaping substantial profits.

As the FBI has launched a formal investigation viewing North Korea as the culprit, Kim Yo-jong, director of the Workers’ Party General Affairs Department, denied the hacking allegations in statements issued for two consecutive days on the 4th. Regarding this, Carlsen said North Korea’s claims are not credible at all, adding, “We would gladly prove North Korea’s responsibility (for the hack) in court.”

On how he could conclude so quickly after the hack that North Korea was responsible, he said, “A core feature of North Korea, even compared with other advanced persistent threats (APTs), is that it is extremely sloppy,” because “they do not face consequences.” Since they are not identified and subjected to investigation or punishment, rather than focusing on covering their tracks after the crime, they “single-mindedly pursue cashing out by selling off assets quickly.” As for which targets North Korean hacker groups might go after next, he added, “Anyone handling large-scale virtual assets can be a target. Binance was targeted first because it was the largest.”

Carlsen said it was fortunate that, after the Binance hack, major stablecoin issuers Tether and Circle urgently froze the stolen assets, noting that “this showed that crypto is not designed to confer special advantages only on criminals; there are also tools to respond to crime.” Thanks to the asset freezes, “North Korea likely walked away with around $3 billion, not the full $6.3 billion siphoned from Binance. This is a success case, and there could be further freezes targeting North Korea or its Chinese partners in the future,” though “for now, the attacker still has the upper hand.”

Malicious cyber activity such as hacking is the largest funding source for North Korea’s nuclear and missile development, as international sanctions have choked its finances. With the U.N. Security Council’s Panel of Experts under the North Korea Sanctions Committeelong a ‘CCTV’ for sanctions enforcementdissolved due to Russia’s veto, and with China and Russia showing reluctance to implement sanctions, North Korea’s sanctions evasion has become bolder.

Carlsen said that traditional financial sanctions led by the United States, such as those by the Treasury Department’s Office of Foreign Assets Control (OFAC), have also weakened, noting, “Without meaningful cooperation from China and Russia, sanctions are impossible, and China is actively obstructing investigations into North Korea’s sanctions violations.” Asked whether China might take a more cooperative stance on North Korea sanctions in light of the Binance incident, he noted that North Korea hacked Chinese-affiliated exchanges such as HTX and Poloniex on a large scale a few years ago, and that Binance is also owned by Chinese-affiliated operators, adding, “China may take this incident seriously this time, but if past precedent is any guide, it willnot ultimately take substantive action.”

In a 2023 interview with the Kyunghyang Shinmun, when South Korea and the United States were strengthening joint responses to North Korea’s cyber threats such as virtual-asset theft, Carlsen called North Korea a ‘modern-day pirate state’and he still thinks so. “North Korea alone criminalizes the state’s cyber capability. No other hostile state in the world does this,” he said, adding, “Because the United States, South Korea, and Japan are most exposed to the security threats posed by North Korea, they should respond more proactively.”