AI malware from the North Korea APT group targets the global blockchain community

A dangerous cyberattack has been revealed, in which North Korea’s APT KONNI hacker group used AI-generated tools to target blockchain developers. On January 21, 2026, Check Point - a leading security company - published a detailed report on this malicious campaign, revealing that blockchain programmers in multiple countries have become targets of hackers linked to North Korea.

Attack scope spans three continents

Blockchain programmers working at companies in Japan, Australia, and India have been targeted by the APT KONNI group. This is not a random attack - the hackers carefully selected experts with deep knowledge of blockchain technology and cryptocurrencies. The presence of targets across three continents indicates the scale and ambition of this malicious operation by actors connected to North Korea.

Malicious distribution tactics via Discord

A notable point is that the APT KONNI group exploited the Discord platform - a popular chat application within the tech community - to host and distribute malicious files. Discord servers were used as repositories for PowerShell attack tools, making the malware spread more effective and harder to detect. This shows that the attackers have adapted to the operational methods of the tech community to optimize their attack strategies.

Increasing danger from AI-generated malware

What is particularly concerning is that the malware was created using advanced AI technology. The combination of North Korea’s hacking capabilities and AI support has significantly increased the ability to bypass security systems. Blockchain developers, despite their high expertise, remain vulnerable to this sophisticated form of attack.

What the community needs to know

Reports from NS3.AI and in-depth analysis by Check Point provide a basis for the global blockchain community to heighten awareness. Especially, experts in countries like Japan, Australia, and India need to strengthen protective measures. This campaign demonstrates that forces from North Korea continue to regard the blockchain community as a key target in their cyberattack activities.