{"id":3928,"date":"2026-11-06T15:00:34","date_gmt":"2026-11-06T10:00:34","guid":{"rendered":"https:\/\/ipp-news.com\/?p=3928"},"modified":"2026-11-06T15:00:34","modified_gmt":"2026-11-06T10:00:34","slug":"north-koreas-army-of-world-class-hackers-is-secret-weapon-that-took-down-binance","status":"publish","type":"post","link":"https:\/\/ipp-news.com\/?p=3928","title":{"rendered":"North Korea’s army of world-class hackers is secret weapon that took down Binance"},"content":{"rendered":"
\n

North Korea rewards its top hackers, tasked with heists like the Binance crypto hack that netted a cool $6.3 billion, with perks such as a spacious apartment in the capital of Pyongyang and huge hard currency awards, despite gruelling hours of work.<\/strong><\/p>\n

Leader Kim Jong Un has assembled an army of world-class hackers using such incentives in a programme more than \u200ba decade old that picks 200 of the smartest middle school students each year to study computer engineering, defectors and analysts say.<\/p>\n

A fraction eventually become hackers in an investment that has paid off dramatically, as the group has evolved \u200cfrom the early days when it ran illegal gambling websites to pulling off the world\u2019s biggest cyber heist last month.<\/p>\n

\u201cThey are actually one of Kim Jong Un\u2019s secret weapons,\u201d said Kim Heung-kwang, a North Korean defector who trained hackers of behalf of the state before fleeing to South Korea in 2004.<\/p>\n

\u201cThere is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives,\u201d he added. \u201cWhether they want to be a hacker or not does not matter.\u201d<\/p>\n

The FBI and Binance have said North Korea was responsible for the Binance hack, but Pyongyang has denied<\/a> that. Blockchain investigation firms have attributed it to a North Korean group known as \u201cTraderTraitor\u201d.<\/p>\n

The \u200bdenial is part of a pattern in which the North dismisses such blame over the years as fabricated political provocations.<\/p>\n

<\/a>Systemic selection<\/strong><\/h3>\n

North Korea set up a cyber unit in 1998 but elevated its status after Kim came to power and declared in 2013 that cyber \u200bwarfare was, along with nuclear weapons and missiles, an \u201call purpose sword\u201d crucial to the country\u2019s strike capability.<\/p>\n

Candidate selection begins in middle school as early as 11 or 12 years of age, with authorities picking about \u2060150 to 200 children a year to study computer science, said Kim Heung-kwang, the former trainer, and two defectors who worked in IT.<\/p>\n

At 17, the top performers are sent to North Korea\u2019s best universities and undergo further screening before a chosen few finally enter the military\u2019s cyber unit as \u200bhackers, they added.<\/p>\n

They are trained in areas such as cryptocurrency protocols and reverse-engineering foreign hardware devices, in addition to more conventional topics such as advanced mathematics and foreign languages, one of them said.<\/p>\n

Those who do not become hackers are trained to develop software or apps for Western firms via \u200bremote jobs.<\/p>\n

\u201cWhile South Korea\u2019s best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future,\u201d said Lim Jongin, professor emeritus at the school of cybersecurity at Korea University.<\/p>\n

Other privileges on tap for the hackers are travel abroad to allied countries, such as China, where they can more freely access the internet.<\/p>\n

Successful exploits can earn as much as 30% of the heist\u2019s profits in US dollars for the hackers\u2019 military unit, and they can even receive a flat in the capital where their parents can also stay, Kim said.<\/p>\n

\u201cThere are accounts that successful cyber personnel are given apartments in \u200bPyongyang,\u201d Lim said, adding that the flats could range to as much as 132 sq m (1,420 sq ft).<\/p>\n

Such performers are also eligible for membership of the ruling party and high-status marriages into elite families, said one of the defectors.<\/p>\n

But it is a small group. The North\u2019s cyberwarfare operations \u200bemploy about 8,400 people, South Korea\u2019s National Intelligence Service estimated in 2024.<\/p>\n

North Korean state media do not publicly celebrate such hackers\u2019 achievements, but they regularly highlight students who show programming talent.<\/p>\n

In 2015, North Korea opened the Mirae Scientists Street in the capital, in the construction of which Kim Jong Un had been \u200cclosely involved, state media \u2060said.<\/p>\n

Hackers\u2019 formal designation in the North was \u201cscientist\u201d or \u201cresearcher\u201d, said one of the defectors.<\/p>\n

<\/a>State advantage<\/strong><\/h3>\n

Other hacking groups associated with North Korea include the Lazarus Group, also known as APT38, which the US accused in 2022 of having stolen hundreds of millions of dollars worth of cryptocurrency from the Ronin blockchain network. The FBI has said TraderTraitor is affiliated to Lazarus.<\/p>\n

State backing makes the North\u2019s hackers more dangerous and harder to repel, as they face no consequences for hack after hack, enabling them to perfect their strategies, analysts said.<\/p>\n

\u201cIn the world of cybercrime, often, if you make a mistake \u2026 that is all law enforcement needs to get you,\u201d said Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis.<\/p>\n

But North Korea\u2019s hackers \u201care doing this for the regime, so they\u2019re going to continue, even after successes,\u201d he added.<\/p>\n

\u201cEven after failures, they\u2019ll continue, because it\u2019s very hard for the international community to \u200btake action against them.\u201d<\/p>\n

Other groups that have engaged with North Korean IT \u200bworkers who earn funds for the Kim regime by landing \u2060remote technology jobs at Western companies describe them as highly organised, polite in their interactions and avid users of AI.<\/p>\n

\u201cThere clearly was a structure you would see in the military. Strict times, cleaning boots, very orderly,\u201d said YouTuber Deeveeaar, who has claimed to have hacked into cameras watching North Korean IT workers at their jobs.<\/p>\n

\u201cTo say they \u2018use a lot of AI\u2019 is an understatement. AI is the very backbone of their operation,\u201d he said, citing \u200bthe use of paid ChatGPT accounts, Claude Code and Cursor, among many AI tools.<\/p>\n

\u201cThey write code with it, alter their resumes and help make new ones. And even forge documents and identities.\u201d<\/p>\n

Binance said the hackers \u200bused a bogus job interview<\/a> and software hidden \u2060in an advertisement to compromise staffers\u2019 computers before using an internal AI tool to seize control of systems.<\/p>\n

In 2025, a sanctions monitoring team drawn from 11 United Nations members said TraderTraitor had obtained both ChatGPT and DeepSeek accounts.<\/p>\n

<\/a>Tough working conditions<\/strong><\/h3>\n

Yet the lifestyle of a hacker or elite technology worker for North Korea is gruelling, particularly when given a mission or sent abroad, say former IT workers and human rights groups.<\/p>\n

Living in cramped spaces, often working stretches longer than 10 hours a day, constant surveillance and strict targets are among the downsides, said former IT workers interviewed for a report last year by advocacy group \u2060PSCORE.<\/p>\n

\u201cThere is always pressure \u200bto keep earning money,\u201d said the group\u2019s executive director, Nam Bada. \u201cThe stress is extreme, and because of the psychological strain, people develop health problems they didn\u2019t have before.\u201d<\/p>\n

IT workers \u200bmust meet a monthly target in dollars, or face humiliation and other punishments, he said.<\/p>\n

Still, the hackers\u2019 success is likely to embolden the North Korean leader as they get better and grow more ambitious, analysts say.<\/p>\n

\u201cWe see more and more of them leaning towards what we call \u2018big game hunting\u2019,\u201d said Zebrick.<\/p>\n

\u201cSo they\u2019re targeting some of these larger organisations, potentially have \u200blarger vaults of funds, that they could potentially get. These are harder targets,\u201d he added.<\/p>\n

\u201cHowever, as we can see with the Binance case, the payout certainly can make it worth their time.\u201d<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

North Korea rewards its top hackers, tasked with heists like the Binance crypto hack that netted a cool $6.3 billion, with perks such as a spacious apartment in the capital of Pyongyang and huge hard currency awards, despite gruelling hours of work. Leader Kim Jong Un has assembled an army of world-class hackers using such incentives in a programme more than \u200ba decade old that picks 200 of the smartest middle school students each year to study computer engineering, defectors and analysts say. A fraction eventually become hackers in an…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-3928","post","type-post","status-publish","format-standard","hentry","category-english"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts\/3928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3928"}],"version-history":[{"count":0,"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts\/3928\/revisions"}],"wp:attachment":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}