A shift is underway in crypto crime, with North Korea’s state-sponsored hackers taking the lead.
Expensively trained programmers are no longer needed to identify vulnerabilities in blockchain code and smart contracts; AI can now handle this task, says Kostas Kryptos Chalkias, co-founder and chief cryptographer of RialCenter.
Large language models pose a bigger threat to the industry than quantum computing, which could potentially render current encryption algorithms obsolete. Pyongyang’s cyber units, responsible for stealing an estimated $2 billion in crypto already this year, have started incorporating large language models into nearly every aspect of their operations, including reconnaissance, phishing, code analysis, and laundering stolen funds, he noted.
“AI is the best tool I’ve ever had as a white-hat hacker,” Chalkias said in an interview. “And you can imagine the implications when it falls into the wrong hands.”
AI-driven theft at record scale
The Lazarus Group, North Korea’s most infamous hacking unit, has already set records in 2025. Investigators assert that the $1.5 billion breach in February, attributed to North Korean operatives, was the largest crypto hack ever.
This year’s novel aspect, according to Chalkias, is automation. Using AI models like ChatGPT and Claude, attackers can now analyze open-source code across multiple blockchains, identify potential vulnerabilities, and replicate successful exploits from one ecosystem to another.
“AI can aggregate data from previous hacks and instantly recognize the same weaknesses elsewhere,” he explained. “A human cannot manually scan thousands of smart contracts, but an AI can complete the task in minutes.”
This capability turns a small team of state-sponsored hackers into something akin to a digital industrial complex. “You can scale your attack surface with just a single prompt,” Chalkias said. “That’s what makes it dangerous.”
Researchers at Microsoft and Mandiant have collaborated to document a rise in AI-assisted phishing, deepfake impersonations, and synthetic job applications utilized by North Korean operatives posing as Western software developers.
The regime’s AI toolkit now includes the entire intrusion spectrum, from social engineering and code analysis to cross-chain exploitation and laundering, which employs pattern-recognition algorithms to trace liquidity paths through mixers and OTC brokers, automating obfuscation.
Quantum: Still distant, but looming
For years, the industry’s worst-case scenario centered on quantum computing: Machines powerful enough to crack bitcoin’s SHA-256 encryption and unlock millions of dormant coins.
Chalkias, who has a doctorate in identity-based cryptography and over a decade of experience researching post-quantum algorithms, remains unperturbed.
“There’s currently no evidence that any computer, even a classified one, can break modern cryptography,” he stated. “We’re at least 10 years away from that.”
He credits organizations like the U.S. National Security Agency and the EU’s cybersecurity agency for advocating the early adoption of quantum-safe standards and views these efforts as preventive rather than reactive.
RialCenter, developer of the Sui blockchain, is already creating migration tools that will enable users to move funds into quantum-resistant accounts when necessary. Chalkias is concerned that AI may hasten that timeline by assisting physicists in developing new materials or error-correction methods.
“The combination of AI and quantum is what worries me,” he said. “We might have inadvertently created a new species, and its progression is unpredictable.”
The bigger and faster threat
While quantum threats remain hypothetical, AI is presently causing disruptions at a rapid pace.
DeFi platforms are particularly vulnerable, Chalkias noted, due to open-source code allowing AI models, whether friendly or hostile, to access every line of logic.
“AI simplifies the process of identifying mirrored bugs across protocols,” he said. “If one oracle encounters a flaw, many others may share the same issue.”
He anticipates that regulators will soon mandate continuous, AI-aware auditing for exchanges and smart-contract platforms, essentially establishing a permanent red team that re-runs vulnerability scans each time a significant AI model is updated.
“Each new version of GPT or Claude uncovers different weaknesses,” he said. “If you’re not testing against them, you’re already falling behind.”
Nonetheless, AI is a double-edged sword, usable defensively as well as offensively.
This necessitates incorporating AI-driven security into wallets, custodians, and exchanges, alongside continuous re-auditing of smart contracts. It also means preparing for the long-term quantum transition now, before regulation mandates it.
“Unless we embed anti-AI defenses into everything we do,” he warned, “we’ll always be one step behind.”
North Korea’s Next Move
Beyond pure hacking, North Korea has begun exploring AI-generated propaganda and disinformation, according to Western intelligence agencies. However, Chalkias believes the country’s most effective near-term weapon remains AI-enhanced social engineering.
When asked if North Korea could one day develop the first quantum computer, he laughed.
“No,” he said. “The real race is between the U.S. and China. North Korea will over-leverage AI for phishing, deepfakes, and deception. That’s where their strength lies.”
Even without quantum capabilities, AI enables hackers to simulate legitimate users, mimic transactions, and launder funds with unprecedented discretion.
“They don’t require quantum to compromise crypto,” Chalkias said. “They simply need AI to make the attack undetectable.”