Financial institutions once famed for ironclad security are experiencing widespread personal data leaks, while cryptocurrency platforms are losing trillions of won. In the era of the AI hacking boom sparked by artificial intelligence, experts point out that a massive transformation is urgently needed in cybersecurity to break away from traditional, formal frameworks.
The U.S. Federal Bureau of Investigation (FBI) announced on October 31 (local time) regarding the theft of over $6 billion (approx. 8.15 trillion won) in virtual assets from Binance, the world’s largest cryptocurrency exchange, stating that it was the work of the Democratic People’s Republic of Korea (North Korea) and blaming the North Korean hacking organization ‘TraderTaitor.’ According to foreign outlets like the Wall Street Journal (WSJ) and Bloomberg, hackers took a mere 20 minutes to steal the 8 trillion won.
The FBI confirmed that TraderTaitor hackers are converting the stolen assets primarily into Ethereum and expects them to continue their money laundering activities. On the same day, U.S. President Donald Trump told reporters at his Mar-a-Lago estate in Florida, “I don’t know if North Korea is behind it, but if so, we will talk to North Korea about this issue.”
The Rising Threat of Supply Chain and Server Vulnerabilities
Financial companies and corporations in South Korea are also suffering from continuous hacking attacks. In particular, vulnerabilities allowing remote code execution were discovered in PHP, a widely used website server language, making the risk of hacking higher than ever. Concerns are growing that weaknesses in external services and software shared by multiple organizations could lead to chain-reaction damages, beyond attacks targeting individual companies. In October alone, the scale of personal data leaks confirmed across 25 major Korean companies and institutions reached approximately 5.34 million cases.
Recent hacking attempts differ from the past in two main aspects. First, instead of frontally penetrating a company’s core computing network, attackers target peripheral connection points. According to a report released by AhnLab on October 29 analyzing hacking incidents in South Korea and Japan over the past month, temporary files left in employees’ sales support systems, external mutual-aid homepages, external backup services, portals, and clouds were cited as intrusion points.
How AI Accelerates Cyber Attacks and Outpaces Defense
Targeting external vendors with multiple clients is another major characteristic. Microsoft (MS) revealed in an October 21 report that a China-linked hacking organization accessed multi-client apps of external IT vendors and attempted to infiltrate client clouds using permissions already granted to the apps. Among the attacks analyzed by MS, some managed to acquire cloud management privileges in less than three hours. This means a security incident in a single cloud service used by multiple companies can lead to sequential breach damages for all clients, even without attacking them individually.
Furthermore, artificial intelligence has increased both the speed and scope of hacking. Professor Kim Bum-soo of Yonsei University’s Graduate School of Information stated, “AI can massively discover vulnerabilities that were previously overlooked or ignored because of low chances of success,” pointing out that connecting multiple discovered vulnerabilities can lead to even stronger attacks.
Shifting Defense Strategies from Prevention to Damage Mitigation
While AI is also utilized in defensive technologies, its limitation lies in the fact that field application takes time compared to attacks. Professor Choi Dae-sun of Soongsil University’s Software Department explained, “An attack only needs to find one flaw and one technique that works, whereas defense requires access control, authentication, detection, and patches to operate together.” He added, “Even when defense technologies exist, it takes time to apply them in the field.”
Experts also point out systemic issues beyond technical responses. According to the Financial Services Commission, which investigated financial sector hacking incidents last month, information gathered by the Financial Supervisory Service and the Financial Security Institute was disseminated to financial companies via an integrated control system, but the data secured independently by each company was not shared with others. Consequently, it was difficult for other companies to anticipate suspicious approaches or new attack methods discovered elsewhere.
Professor Kim Bum-soo emphasized, “In an environment where humans and AI attack together, systems that were secure in the past can no longer be considered safe,” asserting that “it is difficult to make zero accidents the ultimate goal anymore.” He argued, “Instead of trying to reduce accidents to zero, we must prioritize defending critical and vital systems to minimize the resulting damage.”>
