Inside North Korea’s hacker army linked to the $6.3 billion Binance crypto heist
RNA Media illustration for representation.
New Delhi: North Korea’s state-backed cyber operatives have been blamed by the US Federal Bureau of Investigation (FBI) for the $6.3 billion cryptocurrency theft from Binance on October 29, exposing the growing threat posed by Pyongyang’s hacking capabilities. A Reuters investigation published on Friday reveals how Kim Jong-un’s government systematically recruits talented schoolchildren, trains them in advanced computing and selects a few for military cyberoperations.
The FBI attributed the theft to TraderTraitor, a North Korean-linked hacking operation, in an October 31 advisory. Investigators said stolen assets were being converted primarily into Ether and urged cryptocurrency platforms to block transactions associated with identified wallets.
Pyongyang rejected the allegations, with Kim Yo-jong, the North Korean leader’s sister, describing them as a “grave political provocation”, RNA Media reported on Tuesday.
How North Korea builds its cyber workforce
North Korea established a cyber unit in 1998 and elevated its importance under Kim Jong-un, who reportedly described cyber warfare as an “all purpose sword” alongside nuclear weapons and missiles in 2013. Authorities select approximately 150–200 promising students annually, some aged just 11 or 12, for specialized computer-science education, Reuters reported, citing defectors and analysts.
Top performers undergo further screening around age 17 before entering leading universities. Selected candidates receive training in advanced mathematics, cryptocurrency protocols, reverse engineering and foreign languages.
Former hacker trainer Kim Heung-kwang described the operatives as one of Kim Jong-un’s secret weapons.
Successful hackers reportedly receive foreign currency rewards, apartments in Pyongyang, overseas travel privileges and eligibility for ruling-party membership. Kim told Reuters that military cyberunits could receive up to 30 per cent of proceeds from successful operations.
South Korea’s national intelligence service estimated North Korea’s wider cyber workforce at 8,400 personnel in 2024, including intelligence, financial and technology related activities.
Those not selected for military units may undertake overseas software development and remote IT work to generate foreign currency. Former workers interviewed by human rights organization PSCORE described shifts exceeding 10 hours, constant surveillance and strict monthly earnings targets, with punishment or humiliation for failing to meet quotas.
How the Binance attack unfolded
Binance’s November 3 investigation described a months-long operation beginning in June, when an employee downloaded compromised software while searching for an AI coding tool.
In September, another engineer was approached by fake recruiters and persuaded to download a coding assignment containing malware.
On October 20, attackers exploited compromised computers and an internal AI tool to access additional engineers’ systems. Nine days later, stolen credentials and malicious scripts enabled unauthorized cryptocurrency transfers from Binance’s wallet infrastructure.
Binance said its security teams had blocked 57 suspected North Korea-linked cyberthreats during 2026, including malicious software and fraudulent recruitment attempts.
The exchange reported that 98 per cent of affected token assets had been replenished as of October 31, while approximately $2.85 billion had been frozen or intercepted. Binance had earlier reported 95 per cent replenishment, RNA Media reported on November 1.
Replenishing assets does not mean the stolen cryptocurrency has been recovered.
AI, sanctions and stolen funds
The FBI has linked TraderTraitor to the broader Lazarus network, previously implicated in the 2022 Ronin Network theft and the $1.5 billion Bybit attack in February 2025.
North Korean cyber personnel reportedly use AI tools, including ChatGPT, Claude Code and Cursor, to write software, prepare job applications and fabricate identities, Reuters reported. A 2025 sanctions-monitoring investigation also identified North Korean-linked accounts using ChatGPT and DeepSeek.
However, blockchain intelligence firm Elliptic found no evidence that autonomous AI agents directed the laundering. Its November 6 analysis identified approximately $3.11 billion remaining in addresses linked to the theft, alongside the $2.85 billion frozen.
The multilateral sanctions monitoring team estimated that North Korean actors stole $1.19 billion in cryptocurrency in 2024 and at least $1.65 billion between January and September 2025.
International investigators have linked such operations to sanctions evasion and potential funding for prohibited weapons programmes, although the ultimate destination of Binance’s stolen assets remains unconfirmed.
The Binance breach underscores the challenge facing international investigators as North Korea’s alleged cyberoperations combine state-directed training, financial incentives and increasingly sophisticated methods of stealing and moving digital assets.
