North Korea Hackers Behind Record Binance Heist Are Kim Jong Un’s Secret Weapon, Defectors Say
Defectors say the state chooses its brightest pupils at 11 or 12 and trains a select few as hackers. The best are rewarded with apartments in Pyongyang, though the hours are long and the pressure is intense.
SEOUL, Nov 6 – The North Korean hackers are selected while they are 11 or 12 years old, and those who succeed can receive an entire flat in Pyongyang and take part of the money that they have stolen, according to sources familiar with the process.
That system, they say, is how the North built the team that stole $6.3 billion from the crypto exchange Binance last month the largest cryptocurrency theft ever recorded.
It works like this: each year, the state selects up to 200 of its brightest middle school students and sends them to study computing. As they grow older, they are tested repeatedly. At 17, the strongest candidates move on to the country’s top universities. From there, only a select few the very best are chosen to join the army’s cyber unit.
“They are truly one of Kim Jong Un’s secret weapons,” said Kim Heung-kwang, who trained hackers for the North before fleeing to the South in 2004.
He said no other country identifies its most talented children with the sole aim of turning them into hackers, regardless of whether they want that life.
The program has been running for more than a decade. In its early years, North Korean hackers operated illegal gambling sites; today, they target some of the world’s largest cryptocurrency firms.
US investigators said last week that North Korea was behind the Binance theft, and Binance says so too. Firms that track crypto have tied it to a North Korean group they call TraderTraitor. The North says it had nothing to do with it, as it has done each time it is blamed.
North Korea first set up a cyber unit in 1998. But it was Kim who made it a top priority. In 2013, he said cyber war was an “all-purpose sword,” just as important as nuclear arms and missiles.
The kids who are picked study math and foreign languages. They also learn how crypto works and how to take apart foreign devices, one of the defectors said. The ones who do not make it as hackers are not wasted. They are trained to write apps and code for Western firms, in jobs they do from a distance.
A cyber expert at a university in Seoul put it simply. In the South, he said, the top students may go into medicine. In the North, they go into the nuclear and cyber programs, and the state takes care of them for life.
The perks are real. When a hack works, the unit behind it can keep up to 30 percent of what it takes, paid in dollars, Kim said. The hackers can also be given a flat in Pyongyang, and their parents can move in with them. Some of those flats are said to be quite large.
The best of them can join the ruling party and marry into top families, one defector said. Some are sent to friendly countries such as China, where they can get online more freely.
But it is not a big team. South Korea’s spy agency thinks about 8,400 people work in the North’s cyber operations.
And because they work for the state, they are hard to stop. A normal criminal can be caught after one mistake. These hackers face no such risk, so they keep going, analysts say.
“They’re going to continue, even after successes,” said Alec Zebrick, who studies crypto crime at the firm Chainalysis. He said they keep going after failures too, since it is so hard for other countries to do anything about them.
People who have dealt with North Korea’s tech workers describe them as highly organized, polite, and unusually reliant on artificial intelligence in nearly every part of their work.
One YouTuber, known as Deeveeaar, who says he hacked into cameras monitoring the workers at their desks, said their daily routines resembled military life: fixed working hours, disciplined conduct, and even clean boots.
“AI is the very backbone of their operation,” he said. According to him, the workers pay for tools including ChatGPT, Claude Code, and Cursor, using them to write code, polish résumés, and even fabricate documents and identities.
Binance says that is how it was targeted. The hackers allegedly used a fake job interview and malicious software hidden in an advertisement to gain access to employees’ computers. They then exploited one of the company’s own AI tools to take control of its systems.
Even so, life for these workers is far from easy. Former employees told the rights group PSCORE that they live in cramped quarters, often work more than 10 hours a day, and are under constant surveillance.
“There is always pressure to keep earning money,” said Nam Bada, who runs the organization. He said workers who fail to meet their monthly dollar targets face humiliation and punishment, and that many suffer health problems caused by prolonged stress.
Analysts believe the hackers will now aim even higher, targeting larger firms with greater sums of money to steal. Those companies are more difficult to penetrate, but as the Binance case demonstrates, the potential rewards can be enormous.
