How North Korea's secret army of world-class hackers took down Binance

SEOUL: North Korea rewards its top hackers, tasked with heists like the Binance crypto hack that netted a cool $6.3 billion, with perks such as a spacious apartment in the capital of Pyongyang and huge hard currency awards, despite gruelling hours of work. Leader Kim Jong Un has assembled an army of world-class hackers using such incentives in a programme more than a decade old that picks 200 of the smartest middle school students each year to study computer engineering, defectors and analysts say. A fraction eventually become hackers in an investment that has paid off dramatically, as the group has evolved from the early days when it ran illegal gambling websites to pulling off the world's biggest cyber heist last month. "They are actually one of Kim Jong Un's secret weapons," said Kim Heung-kwang, a North Korean defector who trained hackers of behalf of the state before fleeing to South Korea in 2004. "There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives," he added. "Whether they want to be a hacker or not does not matter." The FBI and Binance have said North Korea was responsible for the Binance hack, but Pyongyang has denied that. Blockchain investigation firms have attributed it to a North Korean group known as "TraderTraitor". The denial is part of a pattern in which the North dismisses such blame over the years as fabricated political provocations. Systemic selection North Korea set up a cyber unit in 1998 but elevated its status after Kim came to power and declared in 2013 that cyber warfare was, along with nuclear weapons and missiles, an "all purpose sword" crucial to the country's strike capability. Candidate selection begins in middle school as early as 11 or 12 years of age, with authorities picking about 150 to 200 children a year to study computer science, said Kim Heung-kwang, the former trainer, and two defectors who worked in IT. At 17, the top performers are sent to North Korea's best universities and undergo further screening before a chosen few finally enter the military's cyber unit as hackers, they added. They are trained in areas such as cryptocurrency protocols and reverse-engineering foreign hardware devices in addition to more conventional topics such as advanced mathematics and foreign languages, one of them said. People watch a TV broadcasting a news report on recent messages from Kim Yo Jong, the sister of North Korean leader Kim Jong Un, against the Binance hack accusation, at a railway station in Seoul, South Korea, November 4, 2026. (Reuters) Those who do not become hackers are trained to turn out software or apps for Western firms via remote jobs. "While South Korea's best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future," said Lim Jongin, professor emeritus at the school of cybersecurity at Korea University. Other privileges on tap for the hackers are travel abroad to allied countries, such as China, where they can more freely access the internet. Successful exploits can earn as much as 30% of the heist's profits in US dollars for the hackers' military unit, and they can even receive a flat in the capital where their parents can also stay, Kim said. "There are accounts that successful cyber personnel are given apartments in Pyongyang," Lim said, adding that the flats could range to as much as 132 sq m (1,420 sq ft). Such performers are also eligible for membership of the ruling party and high-status marriages into elite families, said one of the defectors. But it is a small group. The North's cyberwarfare operations employ about 8,400 people, South Korea's National Intelligence Service estimated in 2024. North Korean state media do not publicly celebrate such hackers' achievements, but they regularly highlight students who show talent for programming. In 2015, North Korea opened the Mirae Scientists Street in the capital, in the construction of which Kim Jong Un had been closely involved, state media said. Hackers' formal designation in the North was "scientist" or "researcher", said one of the defectors. State advantage Other hacking groups associated with North Korea include the Lazarus Group, also known as APT38, which the US accused in 2022 of having stolen hundreds of millions of dollars worth of cryptocurrency from the Ronin blockchain network. The FBI has said TraderTraitor is affiliated to Lazarus. State backing makes the North's hackers more dangerous and harder to repulse, as they face no consequences for hack after hack, enabling them to perfect their strategies, analysts said. "In the world of cyber crime, often, if you make a mistake ... that is all law enforcement needs to get you," said Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis. But North Korea's hackers "are doing this for the regime, so they're going to continue, even