How Kim Jong Un has built the world's most feared team of hackers - with skilled youngsters identified early and trained to become elite cyber thieves

Building an elite cyber army

Cash-strapped North Korea, cut off from the rest of the world by sanctions, is resorting to cyber warfare to help support itself. Dictator Kim Jong Un has established a system that identifies and cultivates technical talent from a young age all with a view towards forging an elite team of hackers to extract income for the hermit kingdom.

With raids on Hollywood studios, Asian central banks and crypto exchanges, the isolated state has become infamous for being the home of the globe's most threatening cyber thieves. It's a reputation that will only be reinforced in the aftermath of their alleged involvement in the $6.3bn hack of Binance this week, which is understood to be the largest financial heist of all time.

Attackers linked by analysts to Pyongyang may have swiped close to double the total amount of crypto stolen globally last year a sum equivalent to almost a fifth of North Korea’s gross national income. Binance, the world's biggest cryptocurrency exchange, halted withdrawals and suspended all deposits.

The anatomy of the Binance breach

An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance's engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals. The bulk of the heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.

North Korean hackers are among the world’s most aggressive and highly skilled cyber actors, Shin Beom-chul, South Korea’s former vice-defence minister, told the Financial Times. They receive systematic training and are deployed to generate foreign currency for the regime.

In recent years, the state's economy has been bolstered by closer ties with Moscow, which Pyongyang has supplied with weapons and troops to support Vladimir Putin's war in Ukraine in exchange for billions of dollars in cash, fuel and payments in kind. But the pariah state, choked by sanctions, still relies on criminal activity to support itself.

A history of state sponsored crypto theft

In 2025, North Korean hackers stole about $2bn, roughly 60 per cent of the global total and 51 per cent more than they took in the previous year, according to blockchain analytics firm Chainalysis. As it builds up its nuclear programme, Pyongyang has invested substantially in cyber warfare, building a system that identifies and trains skilled youngers with the aim of establising a crack team of hackers.

According to South Korea’s National Intelligence Service, the secretive state is estimated to have about 8,400 personnel involved in cyber warfare operations, although the figures include technical support staff and is not limited to professional hackers. Selected students are enrolled in three to five years of advanced technical and cyber warfare training at institutions across the country, with the top performers progressing to specialist university programmes, according to North Korean experts.

One five-year course is hosted at Pyongyang’s elite Moranbong College, which combines military studies with hacking and code-breaking. Certain elite operatives are chosen to receive additional training overseas in China and Russia.

Market fallout and security responses

Following the hacking of Binance, cryptocurrency prices fell. Binance said it would use company funds to cover the losses. Stablecoin issuers including El Salvador-based Tether and the Trump-backed World Liberty Financial froze about half of the stolen assets.

This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it, Binance said in a post on X. The exchange said customer funds were safe and it was working with partners to freeze some of the affected assets, with about $3 billion located so far.

Bitcoin hit a six-week low of $76,368 and ether fell more than 3 per cent to a two-month low of $2,178 before markets stabilised. BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5.3 per cent over the past 24 hours at $699.54, according to CoinGecko, while shaky confidence hit listed crypto exchange shares.