Follow us on Google News
North Korea has developed a state-backed hacking network linked to a $3 billion (approx. ₹2.8 Lakh Crore) cryptocurrency theft targeting Binance.
How Does North Korea Recruit Its Hackers?
North Korea has established a systematic programme to identify and train talented students for cyber operations, according to defectors and security analysts. The programme reportedly selects between 150 and 200 children annually, beginning as early as 11 or 12 years of age, for specialised computer science education.
At 17, top-performing students are sent to leading universities for further screening. Selected candidates eventually enter military cyber units, where they study cryptography, advanced mathematics, foreign languages and reverse engineering. The programme has expanded significantly since Kim Jong Un came to power, with cyber warfare becoming an important component of the country’s security strategy.
What Rewards Do Successful Hackers Receive?
North Korea reportedly offers substantial financial and social incentives to its most successful hackers. According to former trainer Kim Heung-kwang, individuals involved in profitable cyber operations can receive rewards equivalent to 30% of the proceeds allocated to their military hacking units.
Additional privileges reportedly include apartments in Pyongyang, opportunities to travel abroad and access to elite social networks. South Korea’s National Intelligence Service estimated in 2024 that approximately 8,400 people worked in North Korea’s cyber warfare operations.
How Was the Binance Cryptocurrency Hack Carried Out?
The FBI and Binance have attributed the cryptocurrency theft, valued at approximately $3 billion, to North Korea, although Pyongyang has denied responsibility. Blockchain investigators identified a North Korean hacking group known as TraderTraitor as responsible for the operation.
According to Binance, the attackers used a fraudulent job interview and malicious software concealed within an advertisement to compromise employees’ computers. They subsequently exploited an internal artificial intelligence tool to gain control of systems. The FBI has linked TraderTraitor to the Lazarus Group, which has also been accused of stealing hundreds of millions of dollars from the Ronin blockchain network.
How Are AI Tools Supporting Cyber Operations?
Investigators and researchers have identified the growing use of artificial intelligence in operations associated with North Korean hackers. A sanctions monitoring team representing 11 United Nations member states reported in 2025 that TraderTraitor had obtained accounts on ChatGPT and DeepSeek.
Accounts from people who interacted with suspected North Korean IT workers suggest that AI tools are used for coding, modifying resumes and creating fraudulent identities. Despite financial rewards, former workers described demanding conditions involving long working hours, constant surveillance and strict revenue targets.
Security analysts warn that state support enables North Korean hacking groups to continue operating despite failed attacks. Alec Zebrack, a senior manager at Chainalysis, said the groups were increasingly pursuing larger organisations with substantial financial holdings, reflecting a shift towards more ambitious cyber operations.
