North Korean Hackers Deploy AI-Powered Social Engineering in $100K Zerion Attack

Cryptocurrency wallet provider Zerion disclosed that North Korean-affiliated hackers used artificial intelligence to orchestrate a sophisticated social engineering attack that resulted in approximately $100,000 stolen from the company’s hot wallets last week.

The incident marks the second major AI-enabled social engineering attack attributed to North Korean threat actors this month, following the $280 million exploit of Drift Protocol. The pattern signals a strategic shift in North Korean hacking operations, with human vulnerabilities now serving as the primary entry point rather than smart contract weaknesses.

Zerion released a detailed post-mortem analysis on Wednesday confirming that no user funds, applications, or infrastructure were compromised in the breach. The company proactively disabled its web application as a precautionary measure following the discovery of the attack.

According to Zerion’s disclosure, attackers successfully gained unauthorized access to logged-in sessions and credentials belonging to several team members. The hackers also obtained private keys to company-operated hot wallets through the sophisticated operation.

“This incident showed that AI is changing the way cyber threats work,” Zerion stated in its post-mortem report. The company confirmed the attack methodology aligned with similar incidents investigated by the Security Alliance (SEAL) during the same timeframe.

SEAL reported tracking and blocking 164 domains linked to the Democratic People’s Republic of Korea-affiliated group UNC1069 between February and April. The security organization described the group’s operations as “multiweek, low-pressure social engineering campaigns” conducted across multiple communication platforms including Telegram, LinkedIn, and Slack.

The threat actors employ sophisticated impersonation techniques, masquerading as known contacts or legitimate brands. In some cases, they leverage access to previously compromised company and individual accounts to establish credibility with their targets.

“UNC1069’s social engineering methodology is defined by patience, precision, and the deliberate weaponization of existing trust relationships,” SEAL noted in its analysis of the threat group’s operational patterns.

Google’s cybersecurity division Mandiant provided additional context in February, documenting the group’s use of fabricated Zoom meetings and confirmed deployment of AI tools for editing images and videos during the social engineering phase of attacks.

The evolution of North Korean cyber operations in the cryptocurrency sector has accelerated dramatically. MetaMask developer and security researcher Taylor Monahan revealed earlier this month that North Korean IT workers have been systematically embedding themselves within crypto companies and decentralized finance projects for at least seven years.

Blockchain security firm Elliptic emphasized the expanding scope of the threat in a blog post published earlier this year. “The evolution of the DPRK’s social engineering techniques, combined with the increasing availability of AI to refine and perfect these methods, means the threat extends well beyond exchanges,” the firm stated.

Elliptic warned that individual developers, project contributors, and anyone with access to cryptocurrency infrastructure should consider themselves potential targets. The democratization of AI tools has effectively lowered the technical barriers for conducting sophisticated social engineering operations.

The $100,000 theft from Zerion, while relatively modest compared to major cryptocurrency exploits, underscores a troubling trend. North Korean actors are increasingly focusing on human vulnerabilities rather than technical exploits, a shift that presents unique challenges for security teams across the industry.

The Drift Protocol incident earlier this month, which resulted in $280 million in losses, was described as a “structured intelligence operation” by investigators. Both attacks demonstrate the advanced capabilities and patient, methodical approach characteristic of state-sponsored threat actors.

Industry observers note that traditional cybersecurity measures focused on technical vulnerabilities may prove insufficient against AI-enhanced social engineering campaigns. The incidents highlight the critical importance of comprehensive security awareness training and robust verification procedures for all team members with access to sensitive systems.

As artificial intelligence tools become more sophisticated and accessible, security experts anticipate further evolution in threat actor capabilities. The cryptocurrency industry, with its high-value digital assets and often distributed team structures, remains an attractive target for well-resourced state-sponsored hacking groups.

More Reads:

Deutsche Börse Acquires $200 Million Stake in Kraken, Valuing Exchange at $13.3 Billion

High Roller stock surges 130% on Crypto.com prediction market partnership