North Korea Hackers Behind $6.3bn Binance Heist

North Korea hackers are the product of a state programme that picks the brightest schoolchildren and trains them to steal billions, Reuters reported.

North Korea hackers are rewarded with a spacious apartment in Pyongyang and hard currency awards. Leader Kim Jong Un has assembled the force over more than a decade.

“They are actually one of Kim Jong Un’s secret weapons,” said Kim Heung-kwang, a North Korean defector who trained hackers for the state before fleeing to South Korea in 2004.

“There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives,” he added.

North Korea hackers: how the programme picks its operatives

North Korea set up a cyber unit in 1998, and Kim declared in 2013 that cyber warfare was, with nuclear weapons and missiles, an “all-purpose sword” for the country’s strike capability.

Selection begins in middle school, as early as age 11 or 12, with about 150 to 200 children picked each year to study computer science, the defectors said. At 17, the best go to top universities before a chosen few enter the military’s cyber unit.

Trainees study cryptocurrency protocols and reverse-engineering, alongside advanced mathematics and foreign languages. The rest produce software for Western firms through remote jobs.

“While South Korea’s best students may pursue medicine, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future,” said Lim Jongin, professor emeritus at Korea University.

Successful exploits can earn the hackers’ military unit as much as 30 per cent of the heist’s profits in US dollars. Operatives can receive a flat of up to 132 square metres, along with party membership and high-status marriages, Lim said.

The North’s cyberwarfare operations employ about 8,400 people, South Korea’s National Intelligence Service estimated in 2024.

The Binance heist and the Lazarus link

The FBI and Binance have said North Korea was responsible for the hack, but Pyongyang has denied that. Blockchain firms have attributed it to a group known as “TraderTraitor”.

The Lazarus Group, also known as APT38, was accused by the US in 2022 of stealing hundreds of millions in cryptocurrency from the Ronin network. The FBI says TraderTraitor is affiliated with Lazarus.

Binance said the hackers used a bogus job interview and software hidden in an advertisement to compromise staffers’ computers, then used an internal AI tool to seize control.

The Binance breach froze $6.3 billion in assets, and the exchange later moved to cover the losses. The FBI has formally blamed North Korea for the hack, while Pyongyang has rejected the allegations.

State backing makes the North’s hackers more dangerous, analysts said, because they face no consequences and can keep refining their methods.

“In the world of cybercrime, often, if you make a mistake … that is all law enforcement needs to get you,” said Alec Zebrick of Chainalysis. But North Korea’s hackers “are doing this for the regime, so they’re going to continue, even after successes,” he added.

Zebrick said the group was moving towards “big game hunting”, targeting larger organisations with larger vaults of funds. “However, as we can see with the Binance case, the payout certainly can make it worth their time.”

AI tools and gruelling conditions

Other groups that have dealt with North Korean IT workers say they are highly organised and avid AI users. One YouTuber who claims to have hacked into cameras watching them at work said: “To say they ‘use a lot of AI’ is an understatement. AI is the very backbone of their operation.”

The lifestyle is gruelling, former IT workers said: cramped spaces, shifts longer than 10 hours a day, constant surveillance and strict monthly dollar targets. “There is always pressure to keep earning money,” said Nam Bada, executive director of advocacy group PSCORE.

State media do not publicly celebrate the hackers, but they highlight talented programming students. The hackers’ formal designation was “scientist” or “researcher”, one defector said.

The case carries a warning for Pakistan too. As the country builds its digital-assets sector and has formed a crypto industry body, the heist shows how state-backed groups can strike the largest exchanges in the world.

How much did North Korea steal from Binance?

The Binance heist netted $6.3 billion, making it the world’s biggest cyber heist, according to the FBI and Binance.

How does North Korea train its hackers?

The state picks 150 to 200 of the smartest middle school children each year for computer science training, before a chosen few join the cyber unit.

How many people work in North Korea’s cyber operations?

About 8,400 people, according to a 2024 estimate by South Korea’s National Intelligence Service.

What group is blamed for the Binance hack?

Blockchain firms attributed the hack to a North Korean group known as TraderTraitor, which the FBI says is affiliated with the Lazarus Group.