North Korea's army of hackers: Kim Jong Un’s ‘secret weapon’ behind the $6.3-billion Binance hack

The FBI and Binance have blamed Pyongyang for the $6.3-billion cyber heist, while North Korea has denied involvement in the attack.

North Korea has reportedly built an army of highly trained hackers by identifying talented children at a young age, training them in advanced technology and rewarding successful operations with money, luxury apartments and other privileges. The programme, developed over more than a decade, has helped the country emerge as a major force in cybercrime, with its hackers accused of carrying out some of the world's biggest cryptocurrency thefts, according to details cited in a Reuters report.

North Korea’s hackers are accused of increasingly targeting large organisations and cryptocurrency platforms, including in the recent Binance theft. (AFP)

The group has come under scrutiny following the $6.3 billion Binance hack last month. The Federal Bureau of Investigation (FBI) and cryptocurrency exchange Binance have blamed North Korea for the attack. Blockchain investigation firms have attributed it to a North Korean hacking group known as “TraderTraitor”.

However, Pyongyang has denied responsibility, describing such accusations as fabricated political provocations.

How North Korea builds its army of hackers

North Korea's cyber programme reportedly begins with identifying potential recruits when they are still in school. According to defectors and analysts, the government selects around 150 to 200 talented students every year, sometimes as young as 11 or 12, to study computer science.

The most promising students are sent to the country's leading universities at the age of 17. They undergo further screening before a select few are recruited into the military's cyber unit.

Kim Heung-kwang, a North Korean defector who trained state hackers before fleeing to South Korea in 2004, said the country had developed a systematic process to identify and train young talent.

“They are actually one of Kim Jong Un's secret weapons,” Reuters quoted as saying said Kim Heung-kwang.

"There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives," Kwang added. "Whether they want to be a hacker or not does not matter."

Their training reportedly includes advanced mathematics, foreign languages, cryptocurrency systems and methods to reverse-engineer foreign hardware. Those who do not make it into the hacking units are trained to develop software and applications for Western companies through remote jobs.

From illegal websites to billion-dollar cyber heists

North Korea established a cyber unit in 1998, but its importance increased after Kim Jong Un came to power. In 2013, Kim described cyber warfare, alongside nuclear weapons and missiles, as an "all purpose sword" central to the country's military capabilities.

The country's cyber operations have reportedly expanded after Kim's arrival as their leader. In their early days, the hackers operated illegal gambling websites. They have now moved towards targeting major organisations and cryptocurrency platforms.

The FBI has identified TraderTraitor as a North Korean group affiliated with the Lazarus Group, also known as APT38. The United States had earlier accused Lazarus of stealing hundreds of millions of dollars in cryptocurrency from the Ronin blockchain network in 2022, According to a Reuters report.

The Binance attack is another example of the growing scale of these operations. According to Binance, the hackers used a fake job interview and malicious software hidden in an advertisement to gain access to employees' computers. They then used an internal artificial intelligence tool to take control of the systems.

The FBI and Binance have blamed North Korea for the attack, although the country has denied the allegations.

Luxury apartments and financial rewards for successful hackers

North Korea offers significant rewards to hackers who successfully complete operations. These include large payments in foreign currency, opportunities to travel to the allied abroad countries such as China and apartments in Pyongyang, the Reuters report detailed.

Kim Heung-kwang said successful operations could earn hackers' military units as much as 30% of the stolen money in US dollars. Some hackers are also reportedly given apartments in the capital, where their parents can live with them.

"There are accounts that successful cyber personnel are given apartments in Pyongyang," said Lim Jongin, professor emeritus at the school of cybersecurity at Korea University, according to Reuters report.

He added that these apartments could measure up to 132 square metres.

Successful hackers may also receive membership of the ruling party and opportunities to marry into influential or elite families, one defector said.

Lim said North Korea directs its brightest students towards nuclear and cyber programmes, offering them opportunities that other young people may not have.

"While South Korea's best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future," he said.

South Korea's National Intelligence Service estimated in 2024 that North Korea employed around 8,400 people in cyberwarfare operations.

Artificial intelligence becomes part of hacking operations

North Korean IT workers have also been accused of using remote technology jobs at Western companies to generate money for the regime.

People who have interacted with these workers describe them as organised, disciplined and familiar with artificial intelligence tools.

YouTuber Deeveeaar, who has claimed to have hacked into cameras monitoring North Korean IT workers, described the strict working environment.

"There clearly was a structure you would see in military. Strict times, cleaning boots, very orderly," he said.

He also highlighted the extensive use of artificial intelligence in their work.

"To say they 'use a lot of AI' is an understatement. AI is the very backbone of their operation," the YouTuber added.

According to him, these workers use tools such as paid ChatGPT accounts, Claude Code and Cursor.

A sanctions monitoring team comprising 11 United Nations members also reported in 2025 that the TraderTraitor group had obtained ChatGPT and DeepSeek accounts, Reuters reported said.

"They write code with it, alter their resumes and help make new ones. And even forge documents and identities."

Long working hours and strict surveillance

Despite the financial rewards and privileges offered to successful hackers, their working conditions can be difficult.

Former IT workers and human rights groups have reportedly described long working hours, cramped living conditions, constant surveillance and strict financial targets.

A report published last year by advocacy group PSCORE highlighted the pressure faced by North Korean IT workers to meet monthly income targets.

"There is always pressure to keep earning money," said Nam Bada, executive director of PSCORE.

"The stress is extreme, and because of the psychological strain people develop health problems they didn't have before."

Workers who fail to meet their targets can face humiliation and other punishments, he added.

North Korea's hackers move towards bigger targets

Analysts believe the success of operations such as the Binance attack could encourage North Korea to target even larger organisations.

Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis, said state support allows North Korean hackers to continue their operations even after failed attempts.

"In the world of cyber crime, often, if you make a mistake ... that is all law enforcement needs to get you," he said as reported by Reuters.

But North Korea's hackers "are doing this for the regime, so they're going to continue, even after successes," he added.

"Even after failures, they'll continue, because it's very hard for the international community to take action against them."

Zebrick said the groups were increasingly focusing on major organisations with access to larger amounts of money.

"We see more and more them leaning towards what we call 'big game hunting'," he said.

"So they're targeting some of these larger organizations, potentially have larger vaults of funds, that they could potentially get. These are harder targets," he added.

"However, as we can see with the Binance case, the payout certainly can make it worth their time."

(With inputs from Reuters)