Tokyo/ Seoul/The CEO of the Japanese technology conglomerate GMO, Masatoshi Kumagai, warned this Monday of the advance in the malicious use of artificial intelligence (AI) in cyberattacks, while the company announced salary cuts for him and other executives after a recent leak and data theft.
“Before, cyberattacks were guns, now they are machine guns. If we compare it with war, before they were precision bombings, now massive bombings,” he declared at a press conference in Tokyo in which he explained that he used this comparison to make the situation “understandable.”
During his speech, the CEO maintained with a voice broken by tears that there are cases of information leaks every day, as a result of the development of artificial intelligence (AI), so the cyber attacks that have been made public “are the tip of the iceberg.”
“Before, cyber attacks were guns, now they are machine guns. If we compare it with war, before they were precision bombings, now they are massive bombings”
In this sense, he stated that “criminals use this useful tool, threatening lives, companies and society itself”, which is why he refused to pay the attackers, who demanded about 50 million dollars.
Kumagai confirmed that the company’s cloud service was subject to unauthorized access, resulting in the massive leak of customer information, and acknowledged that the affected system had security flaws that they had previously been alerted to.
Due to the company’s poor response, its senior officials, including Kumagai, will see their salaries reduced by between 20% and 30% for three months, the technology conglomerate reported in a statement published on its website.
At the end of October, GMO confirmed unauthorized access to its cloud service and announced a “compensatory payment” of about 28 euros to each customer, while calling on the Government to take action to prevent damage and stating that the Internet is “on the brink of collapse” due to AI.
For the moment, managers ruled out commenting on the authorship of the cyberattack, citing an ongoing investigation, but the Kyodo news agency pointed out that several IP addresses used coincided with a North Korean hacker group.
In this context, over the weekend the US FBI attributed the historic theft to Binance, the world’s largest cryptocurrency exchange platform, to the North Korean group TraderTraitor, the impact of which is estimated at $6.3 billion.
The US FBI attributed the historic theft to Binance, the world’s largest cryptocurrency exchange platform, to the North Korean group TraderTraitor, the impact of which is estimated at $6.3 billion.
The historic theft has once again highlighted the extent of the cyber capabilities of the Kim Jong-un regime, which uses computer attacks as a tool to evade sanctions and finance its weapons programs.
“North Korea’s cryptocurrency theft operations have become a multibillion-dollar threat, with a recent shift toward fewer attacks but much larger thefts,” Alec Zebrick, senior manager of global services at Chainalysis, an American cryptocurrency analysis firm, told EFE.
Attacks attributed to North Korean groups through October 29 of this year accounted for almost 89% of the global value stolen in cryptocurrencies, up from 15% in all of 2021, Zebrick noted, while average losses from cyberattacks attributed to Pyongyang nearly quadrupled to $185.65 million in the same period.
The Chainanalysis representative explained that after the thefts, the hackers They fragment the funds and distribute them among thousands of addresses and platforms to make them difficult to trace, although the transactions leave records that allow assets to be located and frozen before they are converted into conventional money.
Likewise, North Korea would have some 8,400 troops dedicated to cyber operations, according to an estimate by the South Korean Army in 2024.
“North Korean cyber capabilities are only at an intermediate level on a global scale. However, when it comes to computer attacks related to illicit activities, such as financial theft and employment under false identities, it could be considered to be in first place in the world,” Lee Ho-ryung, senior researcher at the South Korean Institute for Defense Analysis (KIDA), told EFE.
“The theft through computer attacks is, without a doubt, sponsored and supported by the North Korean party-state,” Daniel Pinkston, professor of International Relations at Troy University and specialist in North Korea, told EFE.
Pinkston stated that “any currency the regime obtains through legitimate or illicit means is fungible” and that “the leadership can use the funds as they see fit,” although he stressed that weapons of mass destruction programs “are definitely a priority.”
The United States, South Korea and Japan have reported that cryptocurrency thefts allow North Korea to obtain foreign currency and circumvent sanctions imposed for its nuclear and missile programs, while Pyongyang has repeatedly rejected international accusations of its involvement in cyberattacks.
“North Korean exports in 2025 amounted to 470 million dollars, while the theft from Binance reached 6.3 billion,” said researcher Lee, who stressed that cybercrime is an important source of financing for the current modernization of the North Korean Army.
Lee stressed that cybercrime is an important source of financing for the current modernization of the North Korean Army.
Among the best-known antecedents of cyberattacks attributed to North Korea is the one carried out against Sony Pictures in 2014, which caused leaks of confidential information and computer damage after the production of the film ‘The Interview’, which Pyongyang considered offensive against its leader, Kim Jong-un.
The attacks reached other cryptocurrency exchange platforms, such as the South Korean Upbit, which suffered a theft of about $50 million in 2019 and another of $30 million at the end of 2025, and Bybit, which lost about $1.5 billion in February 2025, at the time the largest theft in the sector.
In September of this year, Bitget also reported the theft of $351.6 million, attributed by analysts to TraderTraitor.
Among the main hacker groups linked to Pyongyang, Lazarus, associated with large financial thefts and espionage operations, and Kimsuky, specialized in obtaining confidential information, stand out.
Binance recently announced that it had set aside more than $6.34 billion to cover losses through its own resources and protection funds, and claimed on Sunday to have already replaced 95% of the stolen assets. The final loss is still unknown, after the firm claimed to have frozen some $3 billion of the stolen funds.
