North Korea picks about 200 of its brightest middle-school pupils every year, trains them for years in computer science and turns a chosen few into the state hackers behind the largest cryptocurrency heist in history, according to a Reuters investigation published on November 6. The programme, described by defectors and analysts as more than a decade old, starts with children as young as 11 or 12 — and it has paid off dramatically, culminating in the $6.3 billion Binance hack last month.
The investigation, based on interviews with a former state hacker trainer and two defectors who worked in North Korean IT, lays out a pipeline that is systematic, state-run and — according to the people who described it — unlike anything any other country operates. The FBI and Binance have said North Korea was responsible for the Binance hack, an attribution Pyongyang denies. Blockchain investigators have linked the theft to a North Korean group known as TraderTraitor.
How the pipeline works
Candidate selection begins in middle school. Authorities pick about 150 to 200 children a year to study computer science, Kim Heung-kwang, a North Korean defector who trained hackers for the state before fleeing to South Korea in 2004, told Reuters. Two other defectors who worked in IT gave the same account.
At 17, the top performers are sent to North Korea's best universities, where they face further screening. Only a chosen few then enter the military's cyber unit as hackers. They are trained in cryptocurrency protocols and reverse-engineering foreign hardware, alongside advanced mathematics and foreign languages, one of the defectors said.
| Stage | Age | What happens |
|---|---|---|
| Selection | 11–12 | About 150–200 of the brightest middle-school pupils a year are picked to study computer science |
| University | 17 | Top performers go to North Korea's best universities for further screening |
| Specialist training | Late teens | Three to five years of advanced technical and cyber-warfare instruction; a five-year curriculum at Pyongyang's elite Moranbong College combines military studies with hacking and decryption, according to a 2026 report by the Committee for Human Rights in North Korea |
| Cyber unit | Early 20s | A chosen few enter the military's cyber unit as hackers; the rest are trained for remote software and app jobs at Western firms |
Those who do not make the cut as hackers are not discarded. Reuters reports they are trained to produce software or apps for Western firms through remote jobs — a second revenue stream for the regime that the US Department of Justice says saw North Korean operatives infiltrate more than 300 American companies between 2020 and 2024, generating at least $6.8 million.
"There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives. Whether they want to be a hacker or not does not matter." — Kim Heung-kwang, former state hacker trainer, to Reuters
The rewards — and the price
Success in the programme brings privileges that are extraordinary in one of the world's poorest countries. Top hackers are rewarded with a spacious apartment in Pyongyang and large payments in hard currency, Reuters reports. Successful exploits can earn as much as 30 percent of a heist's profits in US dollars for the hackers' military unit, and performers can receive a flat in the capital where their parents can also live. The flats can be as large as 132 square metres (1,420 sq ft), according to Lim Jongin, professor emeritus at the school of cybersecurity at Korea University.
Other privileges include travel abroad to allied countries such as China, where hackers can more freely access the internet, party membership and high-status marriages into elite families. North Korean state media do not publicly celebrate the hackers' achievements, but regularly highlight students who show talent for programming. In 2015, North Korea opened Mirae Scientists Street in Pyongyang, a showcase residential district for scientists that Kim Jong Un was closely involved in building. Inside the system, hackers are formally designated "scientist" or "researcher".
The lifestyle is also gruelling. Former IT workers interviewed for a report last year by the advocacy group PSCORE described cramped living spaces, working stretches longer than 10 hours a day, constant surveillance and strict targets. "There is always pressure to keep earning money," said the group's executive director, Nam Bada. "The stress is extreme, and because of the psychological strain people develop health problems they didn't have before." IT workers must meet a monthly target in dollars, or face humiliation and other punishments, he said.
Why this matters: the programme is not a side project. Kim Jong Un declared in 2013 that cyber warfare was, along with nuclear weapons and missiles, an "all purpose sword" crucial to the country's strike capability. South Korea's National Intelligence Service estimated in 2024 that North Korea's cyber-warfare operations employ about 8,400 people — a figure that includes technical support staff, not only professional hackers, according to the Financial Times.
From gambling sites to the biggest heist in history
The group has evolved from running illegal gambling websites in its early days to pulling off the world's biggest cyber heist, Reuters reports. The Financial Times reported on October 30 that North Korean hackers stole about $2 billion last year — roughly 60 percent of the global total, and 51 percent more than in 2024 — according to blockchain analytics firm Chainalysis. UN sanctions monitors said in a March 2024 report that they were investigating 58 suspected North Korean attacks on cryptocurrency-related companies between 2017 and 2023, worth roughly $3 billion, with proceeds reportedly contributing to weapons development.
| Year | Target | What happened |
|---|---|---|
| 2014 | Sony Pictures | Cyberattack widely seen as retaliation for the film "The Interview" |
| 2016 | Bangladesh central bank | $81 million stolen in a heist US prosecutors attributed to North Korea |
| 2022 | Ronin network | About $620 million in digital assets stolen; the US accused the Lazarus Group |
| 2024 | DMM Bitcoin, Japan | $308 million stolen by TraderTraitor, a reported sub-unit of Lazarus, according to Japanese investigators |
| Feb 2025 | Bybit, Dubai | About $1.5 billion stolen, according to the FBI — then the largest crypto theft on record |
| Oct 2026 | Binance | $6.3 billion stolen; the FBI and Binance attribute the hack to North Korea, which denies it |
Binance said the hackers used a bogus job interview and software hidden in an advertisement to compromise staff computers, before using an internal AI tool to seize control of systems. The Financial Times noted the sum is roughly a fifth of North Korea's GDP. In 2025, a sanctions monitoring team drawn from 11 UN member states said TraderTraitor had obtained both ChatGPT and DeepSeek accounts.
Why state backing makes them harder to stop
Analysts say state backing is what makes North Korea's hackers more dangerous than ordinary cybercriminals: they face no consequences for failed attempts, so they keep refining their methods. "In the world of cyber crime, often, if you make a mistake … that is all law enforcement needs to get you," Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis, told Reuters. "But North Korea's hackers are doing this for the regime, so they're going to continue, even after successes. Even after failures, they'll continue, because it's very hard for the international community to take action against them."
The same impunity shapes the regime's remote IT workforce. Groups that have engaged with North Korean IT workers describe them as highly organised, polite and avid users of AI. "To say they 'use a lot of AI' is an understatement. AI is the very backbone of their operation," said YouTuber Deeveeaar, who has claimed to have hacked into cameras watching North Korean IT workers at their jobs, speaking to Reuters. "They write code with it, alter their resumes and help make new ones. And even forge documents and identities."
Simon Choi, chief technology officer of cybersecurity startup StealthMole, warned that AI is accelerating the threat. "Artificial intelligence has given wings to hackers," he told the Financial Times. "The gates of hell have opened because North Korea possesses such fierce determination to execute these attacks."
What is not independently confirmed: the recruitment pipeline itself rests on the accounts of defectors — Kim Heung-kwang, who trained hackers for the state before fleeing in 2004, and two defectors who worked in IT — corroborated by experts and by the Financial Times' separate reporting on the training system, the Moranbong College curriculum and the National Intelligence Service's 8,400-person estimate. North Korea denies involvement in cybercrime, calling accusations "absurd slander". The $6.3 billion Binance figure and the attribution to North Korea come from the FBI and Binance; the exact split of the proceeds and the identities of individual hackers have not been publicly established.
What it funds
The money matters because North Korea is cut off from the international financial system by sanctions and faces a severe cash shortage, even as closer cooperation with Russia — weapons and troops for Moscow's war in Ukraine in exchange for cash, fuel and other payments — has eased its economy in recent years. Cyber theft has become a central source of hard currency, and UN monitors say the proceeds help fund weapons development.
"While South Korea's best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future," Lim Jongin told Reuters. The hackers' success is likely to embolden Kim Jong Un as they grow more ambitious, analysts say. "We see more and more of them leaning towards what we call 'big game hunting'," Zebrick said. "So they're targeting some of these larger organisations, potentially have larger vaults of funds, that they could potentially get. These are harder targets. However, as we can see with the Binance case, the payout certainly can make it worth their time."
Frequently asked questions
How does North Korea find its hackers?
According to Reuters' investigation, authorities select about 150 to 200 of the brightest middle-school pupils each year, starting at age 11 or 12. The top performers go to elite universities at 17, and a chosen few enter the military's cyber unit. The Financial Times' separate reporting describes three to five years of advanced training and a five-year curriculum at Pyongyang's Moranbong College.
Was North Korea really behind the Binance hack?
The FBI and Binance have said North Korea was responsible for the $6.3 billion theft, and blockchain firms attribute it to the TraderTraitor group, which the FBI says is affiliated with the Lazarus Group. Pyongyang denies involvement. No individual hacker has been publicly identified.
How much have North Korean hackers stolen in total?
Chainalysis data cited by the Financial Times puts last year's total at about $2 billion — roughly 60 percent of all cryptocurrency stolen worldwide. UN sanctions monitors were investigating 58 suspected attacks worth about $3 billion between 2017 and 2023.
Why can't the hackers simply be arrested?
Because they operate from inside North Korea, on behalf of the state, with no domestic accountability. As one analyst told Reuters, they keep operating after both successes and failures, "because it's very hard for the international community to take action against them".
Do the hackers work alone?
No. The programme also produces remote IT workers who take jobs at Western firms under false identities, earning salaries that flow back to the regime — and sometimes using that access to facilitate further attacks. The US Department of Justice estimates they infiltrated more than 300 American companies between 2020 and 2024.
Key takeaways
- North Korea selects about 150–200 of its brightest 11- and 12-year-olds each year for computer-science training; a chosen few become state hackers.
- The pipeline — reported by Reuters from defector accounts and corroborated by the Financial Times' separate reporting — ends in the military's cyber unit, with rewards including Pyongyang flats and hard currency.
- The system produced the $6.3 billion Binance heist, which the FBI and Binance attribute to North Korea; Pyongyang denies it.
- Chainalysis data puts North Korean crypto theft last year at about $2 billion, roughly 60 percent of the global total.
- State backing and AI tools make the hackers unusually persistent — and, analysts say, increasingly ambitious, moving toward "big game hunting" of larger targets.
What to watch next: whether the United States and its allies impose new sanctions on the networks that move the stolen funds, and whether the UN sanctions monitoring team publishes fresh findings on TraderTraitor's use of AI tools. Binance's investigation into the October breach is continuing, and any further attribution detail from the FBI would sharpen the picture of how the $6.3 billion was taken — and where it went.
