{"schema_version":"0.10.0","id":"LR-2026-0490","record_version":1,"title":"North Korean hackers used AI-enabled social engineering in Zerion attack","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"e2d8edc71304d000c18c95ba15ec37775f5da032a345e2441470f1e713cc1e01"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-14","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Zerion, a crypto wallet company, reported that North Korean-affiliated hackers used AI in a long-term social engineering attack against it. The attacker gained access to some team members’ logged-in sessions and credentials, as well as private keys to company hot wallets, and the company said about $100,000 was stolen from those hot wallets. Zerion stated that no user funds, Zerion apps or infrastructure were affected. The company proactively disabled its web app as a precaution. The company said the attack was similar to campaigns investigated by the Security Alliance (SEAL) the previous week, and SEAL had tracked and blocked 164 domains linked to the DPRK group UNC1069.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":100000.0,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Minor test: contained to one deployer with no third party touched; the source states no user funds, Zerion apps or infrastructure were affected.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.tradingview.com/news/cointelegraph:211485276094b:0-north-korean-hackers-used-ai-enabled-social-engineering-in-zerion-attack/","publisher":"TradingView","date":"2026-04-14","type":"press","title":"North Korean hackers used AI-enabled social engineering in Zerion attack - TradingView","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.adversarial_actor":"C","impact.direct_loss_usd":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Crypto wallet Zerion revealed that North Korean-affiliated hackers used AI in a long-term social engineering attack to steal about $100,000 from the company’s hot wallets last week."}],"event.adversarial_actor":[{"source_index":0,"quote":"Crypto wallet Zerion revealed that North Korean-affiliated hackers used AI in a long-term social engineering attack to steal about $100,000 from the company’s hot wallets last week."}],"impact.direct_loss_usd":[{"source_index":0,"quote":"Crypto wallet Zerion revealed that North Korean-affiliated hackers used AI in a long-term social engineering attack to steal about $100,000 from the company’s hot wallets last week."}],"impact.severity":[{"source_index":0,"quote":"The Zerion team released a post-mortem on Wednesday, where it confirmed that no user funds, Zerion apps or infrastructure were affected and that it had proactively disabled the web app as a precaution."}],"impact.severity_because":[{"source_index":0,"quote":"The Zerion team released a post-mortem on Wednesday, where it confirmed that no user funds, Zerion apps or infrastructure were affected and that it had proactively disabled the web app as a precaution."}],"event.summary":[{"source_index":0,"quote":"Crypto wallet Zerion revealed that North Korean-affiliated hackers used AI in a long-term social engineering attack to steal about $100,000 from the company’s hot wallets last week."},{"source_index":0,"quote":"Zerion said the attacker gained access to some team members’ logged-in sessions and credentials, as well as private keys to company hot wallets."},{"source_index":0,"quote":"The Zerion team released a post-mortem on Wednesday, where it confirmed that no user funds, Zerion apps or infrastructure were affected and that it had proactively disabled the web app as a precaution."},{"source_index":0,"quote":"It confirmed that the attack was similar to those that had been investigated by the Security Alliance (SEAL) last week."}]},"notes_on_gaps":"Only one press source (TradingView republishing Cointelegraph) is provided; the Zerion post-mortem itself is not quoted directly. No exact incident date is stated: 'last week' and 'Wednesday' are relative to the article, and the article date 2026-04-14 is not treated as the disclosure date, so date fields are omitted. The AI was used by the external attacker, not as an autonomous agent in Zerion's systems, so agent_involved, failure_class and system fields are omitted. No root cause, trigger, detection method or responsible party is stated. No controls are named as held, failed or missing, so links are empty. The $100,000 figure is stated as 'about', and it is recorded as 100000 as the only number given. Judgement: severity set to minor because the source says no user funds, apps or infrastructure were affected and the loss was contained to the company. Zerion's own hot wallets were the only reported loss; no third-party count is stated. Context.country is not stated and is omitted. The SEAL and Drift Protocol references concern other incidents and are not used as controls or events of this incident. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}