Crypto wallet provider <a href="https://zerion.io/" rel="noopener noreferrer" target="_blank">Zerion</a> has suffered a highly sophisticated social engineering attack carried out by hackers in North Korea with support from artificial intelligence technology, resulting in the loss of around $100,000 from the company's hot wallets. The attack took place last week and illustrates the changing methods of state-sponsored cybercriminals, who are using more advanced techniques, including an increased focus on using people rather than depending on smart contracts or technical weaknesses, to steal cryptocurrency. According to a post-mortem released earlier today, Zerion stated that no user funds were impacted, nor were any of its consumer-facing apps or core infrastructure impacted. As a preventative measure, the company took the precautionary step of disabling its web app until a complete security review could be conducted to determine whether any further risk existed.<h2>Details of the Attack</h2>Based on information released by Zerion, we know these criminals ran a planned campaign of social engineering that lasted months &amp;/or years and used machine learning (to gain trust and then get access to all employee credentials). They also managed to get into the logged-in sessions of employees as well as their password or login information for them &amp; finally were able to obtain direct access to some of Zerion's hot wallets. "We used this incident to demonstrate that artificial intelligence is revolutionizing the way that cybercrime perpetrator operate," explains the Zerian post-mortem. "This attack was not an opportunistic attack. This was a planned infiltration of internal systems which exploited human weaknesses through social engineering." This month has seen another large-scale attack by <a href="https://www.fbi.gov/investigate/cyber" rel="noopener noreferrer" target="_blank">DPRK</a> hackers utilizing advanced social engineering techniques where an Estonian registered company was breached for over $280 million. Earlier this month, Drift Protocol<a href="https://www.drift.trade/" rel="noopener noreferrer" target="_blank"> </a>(the largest decentralized perpetual futures exchange on Solana) fell victim to an exploit worth approximately $280-$285 million after six months of active intelligence collection by the same group of North Koreans.<h2>The Shifting Threat Landscape: Human Layer Under Attack</h2>North Korean hacking activity has taken a strategic shift. Instead of focusing only on weaknesses within code, hackers are now placing more emphasis on targeting the "human layer" as their main point of entry into crypto companies. The Zerion incident was similar to SEAL's previous investigations and raised concerns about the use of artificial intelligence to assist in socially engineering. AI-assisted social engineering has become a common tactic used to exploit the human element of security by employing deepfake technology, naive voice replication via AI, sophisticated phishing attempts utilizing fraudulent collaboration tools (like Microsoft Teams or Zoom), and long-term impersonation of trusted peers or recruiters. Attackers often take on the role of a job candidate, developer or external partner for long periods of time — sometimes up to months — with the aim of extracting sensitive information or gaining access to organizations. Once they gain access, they can then move laterally and target wallets and internal systems. The $100,000 loss, while minor compared to the hundreds of millions lost through DeFi hacks, is a stark reminder that even very well funded organizations are still at risk from cyberthreats.Zerion characterized the attack as fitting into a general trend of DPRK (North Korea)-based actors using artificial intelligence (AI) to expand and enhance traditional social-engineering techniques to make them more difficult to detect.<h2>Zerion’s Response and Security Measures</h2>Zerion acted swiftly following the discovery of the breach. The company: Isolated affected systems Rotated all relevant credentials and keys Conducted a comprehensive forensic investigation Disabled the web app temporarily As per the team, Customer money, mainly kept in non-custodial wallets owned by them, remained secure all throughout the entire event and not exposed to anything related to this event that would compromise these funds. Also, Zerion will provide information regarding this incident to the cryptocurrency community to help educate others on how to protect themselves from similar events in the future.<h2>Industry Implications</h2>The newest assault reveals numerous alarming trends in 2026: Cyberthreats are democratized by AI: Advanced AI technology is reducing the barriers for social engineering attacks, allowing state-sponsored actors to develop and conduct very realistic-looking interactions on a global scale. Operational Security Focus: As smart contract audits become more thorough, attackers will begin focusing their resources on employee, contractor and internal process targets. State-Sponsored Financial Crime: North Korean cybercriminal groups will continue to use the theft of cryptocurrencies to fund North Korea's regime, while simultaneously laundering the stolen money using complex cross-chain mixing and bridging methods.As a result of these occurrences, the overall result is that the industry is moving toward more rigorous security standards. Many of the protocols and platforms have begun implementing additional security measures, such as: Mandatory hardware security keys in conjunction with multi-party computation (also referred to as "MPC") for sensitive operations AI-based anomaly detection on user-to-user communications Rigorous background checks on new employees or contractors Following a zero trust model when developing internal tools.<h2>Recommendations for Crypto Organizations</h2>The Security Alliance<a href="https://securityalliance.org/" rel="noopener noreferrer" target="_blank"> </a>and additional organizations sent out numerous (issued) new advisories that companies should: Take caution when dealing with communication from anyone that isn’t a (known) contact, including requests to collaborate with them. Create security policies regarding the use of sessions (login/logout) with more strict policies for automatic timeouts. Use hardware wallet that is securely “disconnected” from anything but the device that creates (signs) a transaction. For all transactions that need to be conducted through a “hot” (online) wallet. Provide staff with training on how to spot AI generated content, and other forms of advanced phishing attacks. Revisit (reassess) existing incident response plans (IRP) to include speedy isolating and containment capabilities. As AI technology continues to improve, it will be increasingly difficult for the crypto industry to detect legitimate versus malicious interactions in the future. Zerion's recent breach and the Drift exploit are representative of how technical security is not enough on its own anymore; strong human and operational security practices have become just as important. The community has expressed support and appreciation of Zerion’s publicly disclosing information about their operations for the purpose of improving and enhancing collective defense. This effort will increase awareness of a threat vector that may continue to grow in number.This episode serves as a serious reminder of the vulnerability of our entire ecosystem; in this era of Artificial Intelligence, human ingenuity may be the most dangerous flaw rather than coding error.

North Korean hackers used AI-powered social engineering to steal $100k from Zerion hot wallets. User funds are safe as the firm shifts focus to human-layer security.


North Korean Hackers Use AI-Powered Social Engineering to Steal $100,000 from Zerion Hot Wallets

/media/contribution/car05212d7933f74fb3b29e23e8e6af8415/3l3_0424031236234.stxt

Bitcoin’s Quantum Upgrade Path: What BIP 360 Changes and What It Does Not

/media/contribution/carf291d1f925874cf499c90ae3687ec21a/n7y_0424033348076.stxt

Why Trading Crypto on Public Wi-Fi is a High-Stakes Gamble

/media/contribution/car0c667b2cb61749d8bbe060c7dd4ee431/gl5_0424030319239.stxt

South Korea Is Building a Crypto Tracking System — And Tax Evaders Should Be Paying Attention

/media/contribution/car3de7d9ae8e1b477997aa47e7362a864d/gmm_0424031747904.stxt

Crypto Veteran Li Lin Shifts Gears: Trading Team Heads to Hong Kong's Bitfire

/media/contribution/car567c6a9c4a7544f78618a253f3d748aa/621_0424032910961.stxt

Tether Backs $150M Recovery Plan After Drift Protocol Exploit

/media/contribution/cardcd83a0d8e5f4d159a721b75dbff24d1/fmq_0424032210377.stxt