North Korea Uses Banned AI Hardware to Boost Crypto Theft and Sanctions Evasion

The article explicitly mentions the use of AI-enabled GPUs to conduct cryptocurrency theft and generate fake identities via AI, which are direct harms involving violations of law and harm to communities through illicit financial activities. The AI system's use in hacking and deepfake generation is a direct contributing factor to these harms. Therefore, this event qualifies as an AI Incident due to realized harm caused by AI-enabled activities linked to North Korea's cyber operations.

The article explicitly mentions AI systems being developed and used by North Korea for cyber theft and surveillance, with direct links to substantial crypto theft losses ($172.5 million in November 2025). The use of banned hardware for AI research and the application of AI to enhance attack efficiency and precision demonstrate AI system involvement in causing harm. The harms include financial losses (harm to property) and potential violations of security and privacy through surveillance and social engineering. Therefore, this qualifies as an AI Incident due to realized harm directly linked to AI system use.

The involvement of AI systems is explicit, as the GPUs power AI research for tasks like pattern recognition and data optimization, which are typical AI applications. The use of these AI systems directly contributes to crypto theft, a form of harm to property. Therefore, this event qualifies as an AI Incident due to the realized harm caused by AI-enabled malicious use.

The article explicitly mentions AI systems being developed and used by North Korean cyber units to carry out crypto theft and sanctions evasion, which are forms of harm to property and violations of legal frameworks. The AI's role is pivotal in enabling sophisticated phishing, identity forgery, and laundering operations. The direct link between AI use and realized harm (theft and sanctions evasion) meets the criteria for an AI Incident rather than a hazard or complementary information. The presence of banned GPUs indicates development and use despite restrictions, reinforcing the incident classification.