How North Korea turns child prodigies into crypto thieves

North Korea rewards ⁠its top hackers, tasked with heists like the Binance crypto hack that netted a cool US$6.3 ⁠billion, with perks such as spacious apartments in the capital and huge hard currency awards in return for ⁠gruelling hours of work.

Leader Kim Jong-un has assembled an army of world-class hackers using such incentives in a programme more than a decade old that picks 200 of the smartest middle school students each year to study computer engineering, defectors and analysts say.

A fraction eventually become hackers in an investment that has paid off dramatically, as the group has evolved from the early days when it ran illegal gambling websites to pulling off the world’s biggest cyber heist last month.

“They are actually one of Kim Jong-un’s secret weapons,” said Kim Heung-kwang, a North Korean defector who trained hackers on behalf of the state before fleeing to South Korea in 2004.

“There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives,” ‌he added. “Whether they want to be a hacker or not does not matter.”

The FBI and Binance have blamed North Korea for the Binance hack, though Pyongyang has denied it. Blockchain investigation firms have attributed it to a North Korean group known as “TraderTraitor”.

The denial is part of a pattern in which the North dismisses such blame over the years as fabricated political provocations.

North Korea set up a cyber unit in 1998 but elevated its status after Kim came to power and declared in 2013 that cyber warfare was, along with nuclear weapons and missiles, an “all purpose sword” crucial to the country’s strike capability.

Candidate selection begins in middle school as early as 11 or 12 years of age, with authorities picking about 150 to 200 children a year to study computer science, said Kim Heung-kwang, the former trainer, and two defectors who worked in IT.

At 17, the top performers are sent to North Korea’s best universities and undergo further screening before a chosen few finally enter the military’s cyber unit as hackers, they added.

They are trained in areas such as cryptocurrency protocols and reverse-engineering foreign hardware devices in addition to more conventional topics ⁠such as advanced mathematics and foreign languages, one of the defectors said.

Those who do not become hackers are reportedly trained to turn out software or apps for Western firms via remote jobs.

“While South Korea’s best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programmes and ‌essentially guarantees their future,” said Lim Jong-in, professor emeritus at the school of cybersecurity at Korea University.

Other privileges on tap for the hackers are travel abroad to allied countries, such as China, where they can more freely access the internet.

Successful exploits can earn as much as 30 per cent of the heist’s profits in US dollars for the hackers’ military unit, and they can even receive a flat in the capital where their parents can also stay, Kim said.

“There are accounts that successful cyber ‌personnel are given apartments in Pyongyang,” Lim said, adding that the flats could range to as much as 132 square metres (1,420 sq ft).

High performers were also eligible for membership of the ruling party and high-status marriages into elite families, said one of the ⁠defectors.

But it is a small group. The North’s cyberwarfare operations employ about 8,400 ⁠people, South Korea’s National Intelligence Service estimated in 2024.

North Korean state media does not publicly celebrate such hackers’ achievements, but they regularly highlight students who show talent for programming.

In 2015, North Korea opened the Mirae Scientists Street in the capital, with Kim Jong-un closely involved in its construction, state media said.

Hackers’ formal designation in the North was “scientist” or “researcher”, said one of ‌the defectors.

Other hacking groups associated with North Korea include the Lazarus Group, also known as APT38, which the US accused in 2022 of having stolen hundreds of millions of dollars worth of cryptocurrency from the Ronin blockchain network. The FBI has said TraderTraitor is affiliated with Lazarus.

State backing made the North’s hackers more dangerous and harder to repulse, as they faced no consequences for hack after hack, enabling ‌them to ‌perfect their strategies, analysts said.

“In the world of cybercrime, often, if you make a mistake ... that is all law enforcement needs to get you,” said Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis.

But North Korea’s hackers “are doing this for the regime, so they’re going to continue, even after ‌successes,” he added.

“Even after failures, they’ll continue, because it’s very hard for the international community to take action against them.”

06:17

Meet Kim Ju-ae, Kim Jong-un’s tween daughter and possible next leader of North Korea

Other groups that have engaged with North Korea IT workers who earn funds for the Kim regime by landing remote technology jobs at Western companies describe them as highly organised, polite in their interactions and avid ⁠users of AI.

“There clearly was a structure you would see in military. Strict times, cleaning boots, very orderly,” said YouTuber Deeveeaar, who claims to have hacked into cameras watching North Korean IT workers at their jobs.

“To say they ‘use a lot of AI’ is an understatement. AI is the very backbone ⁠of their operation,” he said, citing use of paid ChatGPT accounts, Claude Code and Cursor, among many other AI tools.

“They write code with it, alter their resumes and help make new ones. And even forge documents and identities.”

Binance said the hackers used a bogus job interview and software hidden in an advertisement to compromise employees’ computers before using an internal AI tool to seize control of systems.

In 2025, a sanctions monitoring team drawn from 11 United Nations member states said TraderTraitor had obtained both ChatGPT and DeepSeek accounts.

Yet the lifestyle of a hacker ‌or elite technology worker for North Korea is gruelling, particularly when given a ‌mission or sent abroad, say former IT workers and human rights groups.

Amon the downsides were constant surveillance, strict targets and often having to work for longer than 10 hours a day, said former IT workers interviewed for a report last year by advocacy group PSCORE.

“There is always pressure to keep earning money,” said the group’s executive director, Nam Bada. “The stress is extreme, and because of the psychological strain people develop health problems they didn’t have before.”

IT workers must meet a monthly target in dollars, or face humiliation and other punishments, he said.

Still, the hackers’ success is likely to embolden the North Korean leader as they get better and grow more ambitious, analysts say.

“We see more and more them leaning towards what we call ‘big game hunting’,” Zebrick said.

“So they’re targeting some of these larger organisations, potentially have larger vaults of funds, that they could potentially get. These are harder targets … However, as we can see with the Binance case, the payout certainly can make it worth their time.”