North Korea’s secret cyber-programme trains talented students for hacking operations. Its TraderTraitor group has been linked to the $6.3bn Binance cryptocurrency theft.
North Korea has developed a state-backed cyber programme that identifies talented children and trains a select number to become elite hackers, with some operatives reportedly receiving cash rewards, luxury apartments and other privileges for successful operations.
The programme has attracted renewed attention following a cryptocurrency theft worth approximately $6.3 billion from Binance, the world’s largest cryptocurrency exchange. The Federal Bureau of Investigation (FBI) has attributed the October 29, 2026, attack to North Korea’s TraderTraitor hacking group, a claim also supported by blockchain investigation firms. Pyongyang has denied responsibility. �
North Korea’s Secret Hacker Recruitment Programme
North Korea’s cyber recruitment system reportedly begins in middle school, with authorities identifying between 150 and 200 academically gifted children each year, some as young as 11 or 12, for specialised computer science education.
According to North Korean defectors and former information technology workers, the most promising students are sent to leading universities at around 17, where they undergo further screening before a small number are selected for military cyber operations.
Their training includes advanced mathematics, foreign languages, cryptocurrency systems and reverse engineering. Students who do not enter the hacking units may instead be assigned to develop software and applications, including work for foreign companies.
The country’s cyber programme was established in 1998 but reportedly expanded significantly under leader Kim Jong Un. In 2013, he described cyber warfare as an essential weapon alongside the country’s nuclear and missile capabilities.
How North Korea Rewards Its Elite Hackers
Despite the demanding nature of their work, successful hackers are reportedly offered substantial financial and social incentives.
Former cyber instructor Kim Heung-kwang said some operatives could receive as much as 30 per cent of the proceeds from successful cyber thefts in foreign currency for their military units.
Other reported benefits include spacious apartments in Pyongyang, opportunities to travel to allied countries such as China, membership of the ruling Workers’ Party and marriages into influential families.
Some hackers are also reportedly allowed to live with their parents in apartments provided by the state.
However, these privileges are reserved for a relatively small group of high-performing operatives. South Korea’s National Intelligence Service estimated in 2024 that North Korea’s wider cyberwarfare workforce numbered approximately 8,400 people.
TraderTraitor and the $6.3bn Binance Hack
North Korea’s cyber operations have increasingly focused on cryptocurrency theft, with the TraderTraitor group among the organisations linked to major attacks.
The FBI identified TraderTraitor as responsible for the October 29 theft of more than $6 billion in virtual assets from Binance. Blockchain analysis firm TRM Labs estimated the stolen amount at approximately $6.36 billion, saying most of the funds were transferred within about 20 minutes.
The group has also been linked to the Lazarus hacking network, which the United States has previously accused of stealing cryptocurrency from digital platforms, including the Ronin blockchain network.
According to the FBI, TraderTraitor actors moved the stolen assets, primarily into Ether, as they prepared to launder the funds through cryptocurrency services.
Binance said the attackers used a fraudulent job interview and malicious software hidden in an advertisement to compromise employees’ computers before exploiting access to its systems.
How State Support Makes North Korean Hackers Difficult to Stop
Cybersecurity analysts say North Korea’s state-backed structure gives its hackers an advantage over conventional criminal groups.
Unlike independent cybercriminals, who may face arrest or prosecution after failed operations, North Korean operatives are reportedly protected by the state and can continue their activities despite setbacks.
Alec Zebrick, a senior manager at blockchain analytics firm Chainalysis, said the hackers could persist even after unsuccessful operations because their activities were carried out on behalf of the regime.
Analysts also say North Korean cybercriminals are increasingly targeting larger organisations with substantial financial resources, a strategy commonly described as big-game hunting.
North Korean IT Workers Are Also Using Artificial Intelligence
North Korea’s cyber operations reportedly extend beyond direct cryptocurrency theft to include overseas information technology workers who secure remote jobs with foreign companies.
People who have interacted with these workers describe them as highly organised, disciplined and increasingly reliant on artificial intelligence tools.
According to YouTuber Deeveeaar, who has investigated North Korean IT operations, workers use AI applications to write and modify code, prepare job applications and create fraudulent identities and documents.
A United Nations sanctions monitoring team comprising 11 member countries reported in 2025 that TraderTraitor had obtained accounts on ChatGPT and DeepSeek.
The use of AI tools has raised further concerns about how North Korean operatives may be improving their ability to conduct cyber operations and conceal their identities.
The Difficult Conditions Behind North Korea’s Cyber Operations
Despite the financial incentives reportedly offered to successful hackers, former workers say life within the programme can be highly restrictive.
A report published by advocacy group PSCORE described cramped living conditions, working days exceeding 10 hours, constant surveillance and strict financial targets.
Nam Bada, the organisation’s executive director, said workers face considerable pressure to generate money for the regime and may experience humiliation or punishment when they fail to meet monthly targets.
The reported conditions highlight the contrast between the privileges offered to a select group of successful hackers and the pressure experienced by ordinary technology workers.
North Korea’s Cyber Operations Could Become More Ambitious
Analysts believe the reported success of the Binance operation could encourage North Korea to pursue larger and more sophisticated cyber thefts.
The country’s state-backed hackers have spent years developing their technical capabilities, targeting cryptocurrency platforms and exploiting weaknesses in international digital systems.
With the growing use of artificial intelligence and continued access to specialised training, cybersecurity experts warn that North Korea’s cyber operations could become increasingly ambitious.
The Binance theft has therefore drawn attention not only to the scale of cryptocurrency-related crime but also to the growing role of state-sponsored hacking in international security.
Discover more from LN247
Subscribe to get the latest posts sent to your email.
