North Korea has built an elite army of hackers, rewarding its most successful operatives with luxury apartments in Pyongyang, foreign travel and huge cash bonuses for carrying out cyberattacks, including the reported $6.3bn Binance heist.
Leader Kim Jong Un has overseen a recruitment programme that has operated for more than a decade, selecting about 200 of the country’s brightest middle school students annually for specialised computer engineering education, according to defectors and analysts.
Only a fraction eventually become state hackers, but the programme has transformed North Korea’s cyber operations from running illegal gambling websites into sophisticated attacks targeting major financial institutions and cryptocurrency platforms.
“They are actually one of Kim Jong Un’s secret weapons,” said Kim Heung-kwang, a North Korean defector who trained hackers on behalf of the state before fleeing to South Korea in 2004.
“There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives,” he added. “Whether they want to be a hacker or not does not matter.”
The FBI and cryptocurrency exchange Binance have attributed the hack to North Korea, although Pyongyang has denied responsibility. Blockchain investigation firms have linked the attack to a North Korean hacking group known as TraderTraitor.
The denial follows a pattern in which North Korea has repeatedly dismissed accusations of cyberattacks as fabricated political provocations.
Systematic Selection
North Korea established a cyber unit in 1998 but significantly expanded its importance after Kim Jong Un assumed power.
In 2013, Kim declared cyber warfare, alongside nuclear weapons and missiles, an “all purpose sword” essential to the country’s military strike capability.
Recruitment begins in middle school, sometimes when children are just 11 or 12 years old. Authorities identify between 150 and 200 students annually for specialised computer science education, according to Kim Heung-kwang and two defectors who previously worked in the country’s information technology sector.
At 17, the strongest candidates move to North Korea’s leading universities, where they undergo further screening before a select few are recruited into the military’s cyber unit.
Their training covers cryptocurrency protocols, reverse-engineering foreign hardware and conventional subjects such as advanced mathematics and foreign languages, one of the defectors said.
Students who do not make it into the hacking unit are trained to develop software and applications for Western companies through remote employment arrangements.
“While South Korea’s best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future,” said Lim Jongin, professor emeritus at the School of Cybersecurity at Korea University.
Successful hackers receive significant financial and social privileges. These include opportunities to travel to allied countries such as China, where internet access is less restricted.
Kim said successful cyber operations could earn hackers’ military units as much as 30 per cent of the proceeds in US dollars. Some operatives also receive apartments in Pyongyang, where their parents can live with them.
“There are accounts that successful cyber personnel are given apartments in Pyongyang,” Lim said, adding that the properties could measure up to 132 square metres (1,420 square feet).
One of the defectors said successful operatives could also qualify for membership of the ruling party and marriages into influential families.
However, the elite hacking force represents only a fraction of North Korea’s wider cyber workforce. South Korea’s National Intelligence Service estimated in 2024 that the country’s cyberwarfare operations employed about 8,400 people.
North Korean state media rarely celebrate the achievements of individual hackers publicly but regularly highlight students who demonstrate exceptional programming abilities.
In 2015, North Korea opened Mirae Scientists Street in Pyongyang, a development whose construction Kim Jong Un closely supervised, according to state media.
One defector said hackers were formally designated as “scientists” or “researchers” within the country.
State Advantage
North Korea’s cyber operations also include the Lazarus Group, also known as APT38, which the US accused in 2022 of stealing hundreds of millions of dollars in cryptocurrency from the Ronin blockchain network.
The FBI has identified TraderTraitor as affiliated with Lazarus.
Analysts say the hackers’ state backing makes them particularly difficult to combat because they operate with little fear of prosecution or other consequences, allowing them to refine their techniques even after failed operations.
“In the world of cyber crime, often, if you make a mistake … that is all law enforcement needs to get you,” said Alec Zebrick, senior manager for Asia-Pacific global services at blockchain analysis firm Chainalysis.
But North Korea’s hackers “are doing this for the regime, so they’re going to continue, even after successes,” he added.
“Even after failures, they’ll continue, because it’s very hard for the international community to take action against them.”
Organisations and individuals who have interacted with North Korean information technology workers, who generate revenue for the Kim regime through remote employment with Western companies, have also described them as highly organised, disciplined and technologically sophisticated.
They are reportedly heavy users of artificial intelligence tools.
“There clearly was a structure you would see in military. Strict times, cleaning boots, very orderly,” said YouTuber Deeveeaar, who has claimed to have hacked into cameras monitoring North Korean IT workers at their workplaces.
“To say they ‘use a lot of AI’ is an understatement. AI is the very backbone of their operation,” he said, citing their use of paid ChatGPT accounts, Claude Code and Cursor, among other tools.
“They write code with it, alter their resumes and help make new ones. And even forge documents and identities.”
Binance said the hackers gained access to employees’ computers through a fake job interview and malicious software concealed in an advertisement.
The attackers subsequently used an internal artificial intelligence tool to take control of the exchange’s systems.
In 2025, a sanctions monitoring team comprising representatives from 11 United Nations member states reported that TraderTraitor had obtained accounts on both ChatGPT and DeepSeek.
Faridah Abdulkadiri
Follow us on:
