North Korea Pulls Off Massive Crypto Heist

November 13, 2026, 11:35 am | Read time: 3 minutes

With fake video conferences, artificial intelligence, and manipulated celebrity videos, North Korean hackers are said to have stolen millions. The U.S. government suspects that the money directly benefits Kim Jong-un’s regime.

Hackers Rely on AI and Psychological Tricks

North Korean cybercriminals are alleged to have stolen cryptocurrencies worth more than $400 million. That equates to about 362 million euros. According to the U.S. Department of Justice, the loot is intended to finance the authoritarian regime of leader Kim Jong-un. For their attacks, the perpetrators apparently combined artificial intelligence (AI) with so-called social engineering methods. In this process, criminals attempt to manipulate people to obtain confidential information or persuade them to install harmful programs.

The approach shows how professional the attackers have become. Instead of exploiting technical security gaps alone, they deliberately rely on their victims’ trust. AI tools help them create deceptively realistic images and videos. U.S. authorities see this as a key component of the alleged fraud scheme.

Germans Also Affected How North Korean Hackers Stole Millions of Euros

Hardly anyone in North Korea has access to the internet at all - the regime only lets its citizens see what they are supposed to

Surprising! This Is What the Internet Looks Like in North Korea

Fake Video Conferences Become a Trap

The hackers are said to have initially invited their victims to virtual meetings. They used videos from previously hacked user accounts for this purpose. During the conversations, they recorded additional footage, which they could use again later. They then claimed there was a technical problem with the video conference. Participants were supposedly sent a link to fix the error. In reality, they installed malware on their computers that could steal cryptocurrencies.

Also of interest: Hackers Attack German Supermarkets

Additionally, so-called deepfakes are said to have been used. In this process, AI manipulates videos so that people appear to make statements or perform actions that never actually happened. The hackers reportedly used fake recordings of influential figures in the crypto industry. This was intended to give the conversations a veneer of credibility and convince potential victims that they were dealing with trustworthy business partners.

U.S. Takes Action Against North Korean Hackers

The U.S. Department of Justice has reportedly already seized cloud storage infrastructure that the suspects are said to have used. The agency also announced coordinated actions against the alleged hackers. Further details of the investigations were not initially disclosed.

North Korea has long been suspected of using cyberattacks to procure money for the state. In early November, the FBI attributed another major attack on the crypto industry to the country. At that time, the trading platform Binance was affected. It reportedly lost cryptocurrencies worth $6.3 billion (about 5.7 billion euros). The case is considered one of the largest attacks on the industry.

This article is a machine translation of the original German version of TECHBOOK and has been reviewed for accuracy and quality by a native speaker. For feedback, please contact us at info@techbook.de.