North Korean Hackers Use AI Tools to Steal Up to $12M in Crypto Despite Low Skill Level
Summary
- • North Korean hacker group HexagonalRodent used ChatGPT, Cursor, and Anima to steal as much as $12M in cryptocurrency from 2,000+ developers over three months
- • The group lacked basic coding skills but used AI to build nearly every component — from malware to fake company phishing sites
- • Security researcher Marcus Hutchins warns AI is enabling low-skill state-sponsored actors to execute campaigns that would otherwise be impossible
Details
HexagonalRodent infected 2,000+ computers and stole as much as $12M in cryptocurrency over three months
Cybersecurity firm Expel identified and named the group. Victims were primarily developers working on small crypto launches, NFT creation, and Web3 projects. The $12M figure is an estimate based on tracked wallet contents; actual amounts drained remain uncertain as some wallets may have been protected by hardware security tokens.
The group used AI tools including ChatGPT, Cursor, and Anima to build nearly every component of the operation
AI tools were used to write the malware, build phishing infrastructure, and design fake company websites. The hackers lacked the skills to code or set up infrastructure without AI assistance, according to researcher Marcus Hutchins.
Attack vector was fake job offers from fabricated tech companies, culminating in a malware-laced coding assignment
HexagonalRodent created full websites for fictional recruiting companies using AI web design tools. Victims were asked to download a coding test infected with credential-stealing malware, in some cases granting access to cryptocurrency wallet keys.
The group left their own infrastructure unsecured, leaking AI prompts used to write malware and a database of victim wallets
The exposed infrastructure allowed Expel to recover the exact prompts used with ChatGPT and Cursor, and to estimate the stolen total from tracked wallet contents. This operational sloppiness is consistent with low-skill operators relying heavily on AI scaffolding.
Malware analysis revealed code was likely entirely AI-generated, annotated in English with emojis throughout
Marcus Hutchins found the malware heavily commented in English — atypical for North Korean developers — and riddled with emojis, a known artifact of LLM-generated code since programmers on PC keyboards rarely include them. This is among the clearest documented evidence of fully AI-authored malware in a live criminal campaign.
Hutchins argues AI is a capability multiplier for low-skill state actors, enabling attacks that would otherwise be impossible
Hutchins, known for disabling the WannaCry ransomware worm, frames this not as sophisticated tradecraft but as capability democratization: the barrier to entry for state-sponsored cybercrime has dropped significantly as AI coding tools become more powerful and accessible.
Security Alert = active threat/incident, Tech Info = attack methodology, Strategy = social engineering approach, Research = technical analysis findings, Insight = analyst interpretation
What This Means
This case is a concrete, documented example of AI tools lowering the floor for state-sponsored cybercrime — not by making elite hackers more dangerous, but by making mediocre ones operational. Security teams and AI platform providers now face pressure to address how their tools are being used to generate malware and phishing infrastructure at scale. Tradecraft fingerprints such as emoji-laden code, English annotations, and exposed prompt logs may help with attribution but do nothing to prevent the initial theft.
Sentiment
Limited public discussion so far, but early reactions alarmed at AI enabling low-skill cybercriminals
“AI Just Democratized Cybercrime! North Korean hackers just stole $12 million in crypto using AI to do literally everything. And they can’t even code... Every AI company building “democratized coding tools” is also building democratized hacking tools.”
“WIRED also has an exclusive on the story.”
Promoting their own detailed research blog on the hackers' AI use
“North Korean hackers stole $12M in crypto in three months. Their secret? They couldn't code, so they used ChatGPT and Cursor to write malware instead. Expel identified a group called HexagonalRodent...”
Split
Insufficient discussion to identify fault lines; early shares uniform in highlighting risks.