Pyongyang penthouses and a $6.3B heist: inside Kim's hacker pipeline

North Korea's hacker army just pulled off the biggest crypto heist ever — and Pyongyang says it had nothing to do with it. The FBI and Binance both blame the North for the Binance hack that netted US$6.3 billion, while blockchain investigators point to a group tracked as TraderTraitor. Pyongyang has denied the accusation, calling it a fabricated political provocation, per channelnewsasia.com.

The hackers didn't come out of nowhere. For more than a decade, Kim Jong Un's regime has handpicked roughly 150 to 200 of its sharpest middle schoolers each year — some as young as 11 or 12 — to study computer engineering, according to defectors and analysts. At 17, the best of them move to the country's top universities for another round of screening before a chosen few slip into the military's cyber unit. Their syllabus goes well beyond math and languages: cryptocurrency protocols and reverse-engineering foreign hardware are on the menu. Those who don't make the cut get quietly rerouted into remote software gigs for Western firms.

The perks are real. Kim Heung-kwang, a defector who once trained state hackers before fleeing in 2004, says successful operators can pocket up to 30 per cent of a heist's profits in hard currency for their unit — and score a Pyongyang apartment where their parents can live too. Professor emeritus Lim Jongin of Korea University puts those flats at up to 1,420 sq ft. Ruling party membership, marriages into elite families and trips to China for unfiltered internet access round out the prize package.

It's a small but growing club. South Korea's National Intelligence Service counted about 8,400 people in the North's cyberwarfare operations as of 2024. The unit dates to 1998, but Kim elevated it after taking power, declaring in 2013 that cyber warfare was an 'all-purpose sword' alongside nukes and missiles. The Lazarus Group — which the US accused in 2022 of draining hundreds of millions from the Ronin blockchain network — is the family name; the FBI says TraderTraitor sits under it.

The lifestyle behind the glory is brutal. Former IT workers describe cramped quarters, shifts stretching past 10 hours, constant surveillance and monthly dollar quotas that carry humiliation or worse if missed. 'There is always pressure to keep earning money,' Nam Bada of advocacy group PSCORE told channelnewsasia.com. 'The stress is extreme, and because of the psychological strain people develop health problems they didn't have before.'

AI is now woven straight through the operation. Binance says the hackers used a bogus job interview and malware hidden inside an advertisement to crack staff machines, then leveraged an internal AI tool to take over systems. A UN sanctions monitoring team reported in 2025 that TraderTraitor had obtained ChatGPT and DeepSeek accounts; a YouTuber who says he hacked into cameras watching North Korean IT workers describes paid ChatGPT, Claude Code and Cursor as the 'very backbone' of the work. Chainalysis's Alec Zebrick warned the group is shifting toward 'big game hunting' — bigger targets, bigger vaults. 'As we can see with the Binance case,' he said, 'the payout certainly can make it worth their time.'