North Korean hackers steal $100K from Zerion using AI social engineering
North Korean state-sponsored hackers stole approximately $100,000 from cryptocurrency wallet provider Zerion in an attack that used AI-enhanced social engineering to compromise an employee's device and access internal company wallets. The attackers exploited operational security gaps rather than flaws in Zerion's smart contracts, with user funds reportedly unaffected.
What happened
North Korean hackers compromised an employee's device at Zerion and exploited their privileged access to drain approximately $100,000 from internal company wallets. The attackers accessed the employee's logged-in sessions, credentials, and private keys required to access the company's internet-connected hot wallets used for testing and internal purposes.
The operation relied heavily on AI-assisted social engineering, with attackers crafting highly convincing interactions and impersonations. According to analysts, these campaigns typically involve weeks of gradual trust-building across platforms like Telegram, LinkedIn, and Slack before executing the final breach.
Reported impact
Zerion confirmed that the breach affected internal company wallets and not user funds. The company stated its core infrastructure and applications remained secure despite the attack.
Zerion temporarily disabled parts of its web application as a precaution and moved affected assets offline while investigating the breach.
Index analysis
The Zerion incident reinforces a pattern of crypto attacks increasingly targeting people rather than protocols. Similar tactics have been identified in other recent incidents linked to North Korean hackers, including long-running infiltration campaigns where attackers pose as developers, investors, or partners.
The use of AI adds a new layer of sophistication to attacks. Tools capable of generating realistic messages, deepfake content, and impersonation scenarios are making phishing and social engineering attacks harder to detect.
The attack did not involve any flaw in Zerion's smart contracts or wallet architecture. Instead, it exploited operational security gaps, which are becoming blind spots that traditional audits and code reviews do not address.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.