AI Risk Wire

Cases › security breach › LR-2026-0490

North Korean hackers used AI-enabled social engineering in Zerion attack

Preliminary Why: Publisher not yet named · subject to change

Status: no action reported

Severity minor
Loss or records US$100,000
Reported 14 Apr 2026

No source states: developer and model, agent tool, could do, deployer, industry.

Severity minor: test: contained to one deployer with no third party touched; the source states no user funds, Zerion apps or infrastructure were affected.

Zerion, a crypto wallet company, reported that North Korean-affiliated hackers used AI in a long-term social engineering attack against it. The attacker gained access to some team members’ logged-in sessions and credentials, as well as private keys to company hot wallets, and the company said about $100,000 was stolen from those hot wallets. Zerion stated that no user funds, Zerion apps or infrastructure were affected. The company proactively disabled its web app as a precaution. The company said the attack was similar to campaigns investigated by the Security Alliance (SEAL) the previous week, and SEAL had tracked and blocked 164 domains linked to the DPRK group UNC1069.

What happened

No source tells the story step by step yet.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week
AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show every field, with its source and grade

What happened

Earliest source we hold
2026-04-14
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it

Impact

Direct loss
$100,000
C one secondary source states it
Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
test: contained to one deployer with no third party touched; the source states no user funds, Zerion apps or infrastructure were affected.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The SEAL and Drift Protocol references concern other incidents and are not used as controls or events of this incident.

LR-2026-0490 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON