North Korea's army of hackers: Kim Jong Un’s ‘secret weapon’ behind the $6.3-billion Binance hack

North Korea has reportedly built an army of highly trained hackers by identifying talented children at a young age, training them in advanced technology and rewarding successful operations with money, luxury apartments and other privileges.

The programme, developed over more than a decade, has helped the country emerge as a major force in cybercrime, with its hackers accused of carrying out some of the world's biggest cryptocurrency thefts, according to details cited in a Reuters report.

North Korea’s hackers are accused of increasingly targeting large organisations and cryptocurrency platforms, including in the recent Binance theft. (AFP)The group has come under scrutiny following the $6.3 billion Binance hack last month.

The Federal Bureau of Investigation (FBI) and cryptocurrency exchange Binance have blamed North Korea for the attack. Blockchain investigation firms have attributed it to a North Korean hacking group known as “TraderTraitor”.

However, Pyongyang has denied responsibility, describing such accusations as fabricated political provocations. North Korea's cyber programme reportedly begins with identifying potential recruits when they are still in school.

According to defectors and analysts, the government selects around 150 to 200 talented students every year, sometimes as young as 11 or 12, to study computer science. The most promising students are sent to the country's leading universities at the age of 17.

They undergo further screening before a select few are recruited into the military's cyber unit. Kim Heung-kwang, a North Korean defector who trained state hackers before fleeing to South Korea in 2004, said the country had developed a systematic process to identify and train young talent.

“They are actually one of Kim Jong Un's secret weapons,” Reuters quoted as saying said Kim Heung-kwang. "There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives," Kwang added.

"Whether they want to be a hacker or not does not matter." Their training reportedly includes advanced mathematics, foreign languages, cryptocurrency systems and methods to reverse-engineer foreign hardware. Those who do not make it into the hacking units are trained to develop software and applications for Western companies through remote jobs.

North Korea established a cyber unit in 1998, but its importance increased after Kim Jong Un came to power. In 2013, Kim described cyber warfare, alongside nuclear weapons and missiles, as an "all purpose sword" central to the country's military capabilities.

The country's cyber operations have reportedly expanded after Kim's arrival as their leader. In their early days, the hackers operated illegal gambling websites. They have now moved towards targeting major organisations and cryptocurrency platforms.

The FBI has identified TraderTraitor as a North Korean group affiliated with the Lazarus Group, also known as APT38. The United States had earlier accused Lazarus of stealing hundreds of millions of dollars in cryptocurrency from the Ronin blockchain network in 2022, According to a Reuters report.

The Binance attack is another example of the growing scale of these operations. According to Binance, the hackers used a fake job interview and malicious software hidden in an advertisement to gain access to employees' computers.

They then used an internal artificial intelligence tool to take control of the systems. The FBI and Binance have blamed North Korea for the attack, although the country has denied the allegations. North Korea offers significant rewards to hackers who successfully complete operations.

These include large payments in foreign currency, opportunities to travel to the allied abroad countries such as China and apartments in Pyongyang, the Reuters report detailed. Kim Heung-kwang said successful operations could earn hackers' military units as much as 30% of the stolen money in US dollars.

Some hackers are also reportedly given apartments in the capital, where their parents can live with them. "There are accounts that successful cyber personnel are given apartments in Pyongyang," said Lim Jongin, professor emeritus at the school of cybersecurity at Korea University, according to Reuters report.

He added that these apartments could measure up to 132 square metres.