North Korea's world-class hacker army — the secret weapon that hacked Binance

The FBI and Binance themselves accused North Korea of the theft. Companies investigating cryptocurrency operations linked the hack to the North Korean group TraderTraitor. Pyongyang denies its involvement.

Former teacher Kim Heung-kwang, who trained state hackers and defected to South Korea in 2004, calls them one of Kim Jong Un's secret weapons.

According to him, the authorities systematically search for the most capable children to turn them into performers of state operations. The desire of the schoolchildren themselves is irrelevant.

Approximately 150-200 children are selected annually for advanced computer science studies, starting from ages 11-12. At 17, the best enter the country's leading universities. After new selections, only a portion makes it into the military cyber unit.

In addition to higher mathematics and foreign languages, they study how cryptocurrencies work and dismantle foreign technology to understand it.

Those who do not become hackers are trained for other work: remotely creating programs and applications for Western companies, earning foreign currency for the regime.

A successful hacker operation can bring the military unit up to 30% of the stolen funds in dollars, says Kim Heung-kwang. The perpetrators themselves can receive an apartment in the capital, where their parents will also be allowed to move.

According to Professor Lim Jong-in of Korea University, the area of such housing can reach 130 square meters. Other privileges include joining the party, marriages with representatives of influential families, and trips to friendly countries, such as China.

Officially, such specialists are called scientists or researchers. State media do not praise their hacks, but regularly report on talented young programmers.

According to South Korean intelligence estimates for 2024, about 8,400 people worked in North Korea's cyber units.

State support gives them a significant advantage. As Alex Zerbrik, a representative of the analytical company Chainalysis, explains, an ordinary cybercriminal can be caught by law enforcement after just one mistake. North Korean hackers continue to work after both successes and failures: the international community has little opportunity to stop them.

Artificial intelligence plays an important role in their work. YouTuber Deeveeaar, who claims to have gained access to surveillance cameras monitoring North Korean IT workers, calls AI the basis of their activities.

According to him, they use paid ChatGPT, Claude Code, and Cursor to write programs, rewrite resumes, create fake documents and identities.

Binance itself reported that the attackers used a fake interview and malware hidden in an advertisement to infiltrate employees' computers. They then used an internal artificial intelligence tool to seize control of the systems.

However, privileges do not mean an easy life. Former North Korean IT workers told the human rights organization PSCORE about workdays longer than ten hours, constant surveillance, and strict dollar earning quotas.

Failure to meet the monthly quota is threatened with humiliation and other punishments. According to PSCORE head Bady Nam, the pressure is so strong that people develop health problems.

Meanwhile, analysts note that North Korean groups are increasingly targeting large companies with significant financial reserves. Hacking them is more difficult, but the Binance example shows how large the spoils can be.

• 1
• 0
• 0
• 1
• 1
• 0
• 0
• 0