It has been reported that North Korean leader Kim Jong-un systematically selected the country's most talented students and assigned them to cyber attack operations.
Reuters' research, based on former technology employees and security experts who escaped from North Korea, revealed the details of the cyber warfare program that the Pyongyang administration has been carrying out for more than a decade.
The US Federal Bureau of Investigation (FBI) held the North Korea-linked group "TraderTraitor" responsible for the theft of over $6 billion worth of cryptocurrencies from Binance on October 29.
Blockchain analysis companies calculated the value of the stolen assets as approximately 6.3 billion dollars.
While the Pyongyang administration denies the accusations, experts state that North Korea's state-sponsored hackers are increasingly targeting large financial institutions.
North Korea created its first cyber operations unit in 1998. However, the importance of the program increased after Kim Jong-un came to power.
In 2013, Kim described cyber warfare as a key element of the country's offensive capability, along with nuclear weapons and missiles.
Kim Heung-kwang, who trained hackers on behalf of North Korea before escaping to South Korea in 2004, explained the importance of the program for the country's administration.
"They are actually one of Kim Jong-un's secret weapons," Heung-kwang said.
Stating that North Korea systematically trains children for cyber operations, Heung-kwang said, "No other country searches for and selects the smartest children in this way, just to turn them into hackers. It does not matter whether the children want to be hackers or not."
THEY ARE SELECTED AT 11 YEARS OLD: 200 STUDENTS EVERY YEAR
North Korea's hacker training program begins when students are still in middle school.
According to former instructors and technology workers who have left the country, authorities select approximately 150 to 200 students aged 11-12 each year to study computer science.
When they turn 17, the most successful students are sent to the country's leading universities.
Only a small portion of the students who undergo new evaluations here are accepted into the army's cyber operations units.
The training program includes areas such as advanced mathematics, foreign languages, cryptocurrency protocols and reverse engineering of foreign hardware.
Students who are not selected as hackers are trained to develop software and applications remotely for Western companies.
Korea University Cyber Security Department Emeritus Professor Lim Jong-in stated that North Korea directs successful students to different fields.
Lim said that in South Korea, successful students can choose prestigious professions such as medicine, while in North Korea, the most talented young people are directed to nuclear and cyber programs.
LUXURY FLAT AND DOLLAR AWARD TO SUCCESSFUL HACKERS
The privileges that North Korea offers to its employees who are successful in cyber operations also attract attention.
According to former instructor Kim Heung-kwang, up to 30 percent of the earnings after successful attacks can be transferred to the relevant military unit in dollars.
Successful hackers can also be allocated apartments where they can live with their families in the capital Pyongyang.
Professor Lim Jong-in stated that some apartments can reach up to 132 square meters.
Other privileges granted to these individuals include membership in the ruling Labor Party, gaining social status through marriage into elite families, and the opportunity to travel to allied countries such as China.
Overseas assignments also allow employees to access the internet more freely than in North Korea.
However, the number of hackers who can take advantage of these privileges is quite limited.
According to the 2024 estimate of the South Korean National Intelligence Service, approximately 8,400 people are working in North Korea's cyber warfare activities.
HOW WAS $6.3 BILLION STOLEN FROM BINANCE?
The attack on Binance, the world's largest cryptocurrency exchange, on October 29, 2026, was recorded as one of the biggest thefts in the history of cryptocurrency.
The FBI and blockchain research companies linked the attack to the North Korea-linked TraderTraitor group.
According to Binance's statement, attackers targeted employees' computers through a fake job interview and malware hidden in an advertisement. Then, he tried to gain control over the systems by using an in-house artificial intelligence tool.
The FBI reported that most of the stolen crypto assets were converted into Ethereum and attempted to be laundered through different decentralized finance platforms.
North Korea denied the accusation that it was involved in the attack.
LAZARUS DETAIL IN NORTH KOREA'S CYBER ATTACKS
Hacking groups associated with North Korea include Lazarus Group.
Lazarus, also known as APT38, has previously come to the fore with the theft of hundreds of millions of dollars of cryptocurrency.
The US administration held Lazarus responsible for the attack on the Ronin blockchain network in 2022, which caused losses of hundreds of millions of dollars.
The FBI states that the TraderTraitor group associated with the Binance attack is also linked to Lazarus.
According to experts, the state support of these groups makes it difficult for international security institutions to intervene.
Alec Zebrick, Senior Director of Global Services for Asia-Pacific at blockchain analysis firm Chainalysis, said ordinary cybercriminals can be caught for minor mistakes, but North Korean hackers are able to operate under state protection.
Zebrick emphasized that even if the operations fail, hackers continue to work and the international community has difficulty taking precautions against these people.
HOW IS ARTIFICIAL INTELLIGENCE USED IN CYBER ATTACKS?
The research also revealed that technology employees affiliated with North Korea use artificial intelligence tools extensively.
YouTuber named Deeveeaar, who claimed that North Korean remote workers had access to their cameras, explained that these people worked in an order that resembled military discipline.
Deeveeaar said, "It would be an understatement to say that you use artificial intelligence a lot. Artificial intelligence is the backbone of its operations."
Stating that employees benefit from tools such as ChatGPT, Claude Code and Cursor, Deeveeaar said that these systems are used to write code, change CVs and prepare new CVs.
It was also claimed that artificial intelligence was also used in the processes of creating fake documents and identities.
The sanctions monitoring team, consisting of representatives from 11 member countries of the United Nations, also reported in the report published in 2025 that the TraderTraitor group acquired ChatGPT and DeepSeek accounts.
WORKING EXCEEDING 10 HOURS A DAY AND CONSTANT SUPERVISION
Despite the privileges offered to successful hackers, it is stated that North Korea's technology workers work under harsh working conditions.
Former technology employees, whose opinions were consulted in the report published by the human rights organization PSCORE last year, explained that especially the personnel working abroad stayed in cramped living spaces, worked more than 10 hours a day and were kept under constant surveillance.
It was reported that monthly income targets were set for employees in dollars, and those who could not reach these targets faced humiliation and various penalties.
PSCORE Executive Director Nam Bada stated that employees are under constant pressure to earn money.
"Stress is extremely high. Due to psychological pressure, people can develop health problems that they have not experienced before," Nam said.
IS NORTH KOREA PREPARING FOR BIGGER CYBER ATTACKS?
Experts evaluate that North Korea-related groups may turn to larger financial targets after the Binance attack.
Chainalysis executive Alec Zebrick said hackers are increasingly targeting large organizations that hold large amounts of assets.
Stating that this approach is called "big game hunting" in the cyber security industry, Zebrick stated that it is more difficult to infiltrate the systems of large organizations, but a successful attack can provide very high profits.
Zebrick stated that the Binance example makes it economically attractive for attackers to focus on more complex and challenging targets.
Findings regarding North Korea's cyber operations indicate that the Pyongyang administration considers digital attacks not only as a security tool, but also as an area of activity that earns foreign currency for the country.
