North Korea has built an entire system for selecting and training hackers, and according to US authorities and Binance, specialists trained in this way are behind the theft of around $6.3 billion in crypto assets from the world's largest cryptocurrency exchange.
The attack was carried out on October 29 and is described as the largest cryptocurrency theft to date. The FBI identifies the TraderTraitor group as responsible, while Binance also links the operation to North Korea. The group is also known by the names Lazarus and APT38.
Pyongyang rejects the allegations. Kim Yo-jong, a representative of the North Korean leadership, described them as “absurd rhetoric” and a political provocation, stating that the US is trying to portray the country as a “cybercriminal state”. North Korea has taken the same position in response to previous accusations of cryptocurrency theft.
Selection Begins as Early as School
According to Reuters, the programme for training cyber personnel begins as early as secondary school. Each year, the authorities select around 200 of the best students, usually aged 11 or 12, and direct them towards computer science.
At the age of 17, the best of them continue at leading universities, where they undergo another selection process. Their training includes cryptocurrency protocols, reverse engineering of foreign hardware, advanced mathematics and foreign languages. A small number of the young people join military cyber units, while the rest are directed towards developing software and applications for Western companies through remote work.
“They are one of Kim Jong Un's secret weapons,” says Kim Hyun-kwan, a North Korean defector who trained hackers for the state before fleeing to South Korea.North Korea created its first cyber unit in 1998. After Kim Jong Un came to power, it was given higher status. In 2013, the leader described cyberwarfare as a “universal sword”, equal to nuclear weapons and missiles.
Privileges in Exchange for Results
South Korea's National Intelligence Service estimates the size of North Korea's cyber operations at around 8,400 people in 2024. The most successful hackers are offered housing in Pyongyang, the opportunity for their parents to live with them, access to the ruling party and marriages to members of the elite.
According to data cited by Reuters, the military unit can receive up to 30% of the proceeds from a successful operation, while individual specialists may be rewarded with hard currency and a home of up to 132 square metres.
However, these privileges come with harsh conditions. Former North Korean IT workers and human rights activists describe cramped premises, working days of more than 10 hours, constant surveillance and monthly financial targets. “The pressure to keep earning is constant, and the stress is enormous,” says Nam Ba-da, executive director of the human rights organisation PSCORE.
Fake Interviews and Artificial Intelligence
Binance reports that the attack began with a fake job interview and malware hidden in a job advertisement. The hackers then used an internal artificial intelligence tool to gain control of the exchange's systems.
According to analyst Alec Zbryk of Chainalysis, North Korean groups are increasingly targeting large organisations with more substantial financial reserves. He describes the approach as “big-game hunting” and warns that more difficult targets can bring significantly greater profits.
Reuters also reports that North Korean IT specialists use paid versions of ChatGPT, Claude Code and Cursor to write code, alter CVs and create fake documents and identities. In 2025, a monitoring team made up of representatives from 11 UN member states established that TraderTraitor had used accounts on ChatGPT and DeepSeek.
Sources: reuters.com, internazionale.it, investing.com