Microsoft says three North Korean hacking groups have now integrated artificial intelligence into their daily attack operations, placing them at the highest tier on the company's assessment scale. Microsoft (NASDAQ: MSFT) rates North Korea's overall use of AI in hacking as high.

The findings come as North Korea faces blame for the largest cryptocurrency theft on record — the $6.36 billion hack of Binance.

How North Korean Hackers Are Using AI

In a report published Thursday, Microsoft Threat Intelligence ranked eight of North Korea's most active hacking groups on a four-step scale: emerging, expanding, accelerating and operationalized. "Operationalized" — the top step — means AI is embedded across a group's entire operation.

Jade Sleet, Coral Sleet and Jasper Sleet sit at the top tier, while Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are in the accelerating step. Emerald Sleet is in the expanding step, and no group currently occupies the emerging tier. The "Sleet" names are Microsoft's designations for North Korean state-backed actors, part of a vendor-specific naming system in which other security firms apply their own labels to the same units.

Microsoft tied the rankings to specific activity. Jade Sleet ran campaigns through three fake companies in a single week. Coral Sleet found a way to plant malware in private code storage. Onyx Sleet generated dozens of custom phishing messages within minutes. Diamond Sleet used AI to build fake people and front companies to deceive its targets. One group reportedly produced more than 100 custom PDF lures aimed at South Korean users in August and September — work that once took days per target.

The groups also relied on AI coding tools. According to Microsoft, operators used tools such as Cursor, a widely used AI-powered code editor, to write code, fix errors and build ways to avoid detection. Onyx Sleet and Pearl Sleet used ARTEX, an open-source tool that tests systems for weaknesses, which can be connected to an AI model and instructed to scout targets on its own. Storm-0940, a China-linked group, reportedly used ARTEX against ConnectWise.

Microsoft's analysts believe humans remain mainly in charge of North Korea's hacking operations, with AI used to speed up work the groups already did, such as scouting targets, producing phishing content and keeping fake identities going.

Microsoft said crypto exchanges and financial firms are among the most common targets of North Korea's cyber operations, since the campaigns aim chiefly to raise money for the regime and gather intelligence. That focus lines up with TRM Labs' research, which found North Korea stole 76% of all crypto hack value in 2026 with just two attacks.

Did AI Play a Part in the Binance Hack?

So far there is no evidence that the attackers behind the Binance hack used AI, and Microsoft's report does not link the theft to any AI technique.

The Binance hack, described as the largest crypto theft on record, took place on October 29. Blockchain research firm TRM Labs said an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes. In a blog post, TRM attributed the attack to TraderTraitor, which it calls North Korea's elite hacking unit — a cluster Microsoft tracks as Jade Sleet — and said it has high confidence in the finding. Jonathan Levin, co-founder of Chainalysis, reached the same conclusion on X.

Binance's own account of the incident outlines how the attackers got in but not what tools they used, according to Cryptopolitan's reporting. The exchange first said a hacked engineer's laptop appeared to be the entry point, but a later probe identified additional "points of breach."

Binance has frozen about $3 billion of the stolen funds, paused withdrawals and pledged to cover user losses. With the exchange's account stopping short of the attackers' tooling, whether AI played any role in the theft remains an open question as investigations continue.