How Kim Jong Un has built the world's most feared team of hackers - with skilled youngsters identified early and trained to become elite cyber thieves

Cash-strapped North Korea, cut off from the rest of the world by sanctions, is resorting to cyber warfare to help support itself.Dictator Kim Jong Un has established a system that identifies and cultivates technical talent from a young age — all with a view towards forging an elite team of hackers to extract income for the hermit kingdom.With raids on Hollywood studios, Asian central banks and crypto exchanges, the isolated state has become infamous for being the home of the globe's most threatening cyber thieves.It's a reputation that will only be reinforced in the aftermath of their alleged involvement in the $6.3bn hack of Binance this week, which is understood to be the largest financial heist of all time.Attackers linked by analysts to Pyongyang may have swiped close to double the total amount of crypto stolen globally last year — a sum equivalent to almost a fifth of North Korea’s gross national income.Binance, the world's biggest cryptocurrency exchange, halted withdrawals and suspended all deposits.An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance's engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals.The bulk of the heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according ​to US blockchain analysis firms TRM Labs and Chainalysis. Kim Jong Un has established a system that identifies and cultivates technical talent from a young age The North Korean dictator aims to forge an elite team of hackers to extract income for the hermit kingdom'North Korean hackers are among the world’s most aggressive and highly skilled cyber actors,' Shin Beom-chul, South Korea’s former vice-defence minister, told the Financial Times.'They receive systematic training and are deployed to generate foreign currency for the regime.'In recent years, the state's economy has been bolstered by closer ties with Moscow, which Pyongyang has supplied with weapons and troops to support Vladimir Putin's war in Ukraine in exchange for billions of dollars in cash, fuel and payments in kind.But the pariah state, choked by sanctions, still relies on criminal activity to support itself.In 2025, North Korean hackers stole about $2bn, roughly 60 per cent of the global total and 51 per cent more than they took in the previous year, according to blockchain analytics firm Chainalysis.As it builds up its nuclear programme, Pyongyang has invested substantially in cyber warfare, building a system that identifies and trains skilled youngers with the aim of establising a crack team of hackers.According to South Korea’s National Intelligence Service, the secretive state is estimated to have about 8,400 personnel involved in cyber warfare operations, although the figures include technical support staff and is not limited to professional hackers.Selected students are enrolled in three to five years of advanced technical and cyber warfare training at institutions across the country, with the top performers progressing to specialist university programmes, according to North Korean experts.One five-year course is hosted at Pyongyang’s elite Moranbong College, which combines military studies with hacking and code-breaking.Certain elite operatives are chosen to receive additional training overseas in China and Russia.'North Korean students who excel in mathematics and science are selected and trained in hacking from their teenage years,' Simon Choi, chief technology officer at cyber security start-up StealthMole, told the FT.Experts say that North Korean cyber thieves are able to operate without fear of prosecution, because they operate on behalf of the state.Choi highlighted how this made them more daring than their overseas counterparts. 'Because they face no accountability at home, they can actively target and hack foreign institutions,' Shin said.North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to US and South Korean authorities as well as cybersecurity experts.The regime relies on such criminal schemes to generate hard currency.In the early 2000s, US authorities accused North Korea of trafficking drugs as well as manufacturing counterfeit cigarettes and sophisticated fake $100 'supernotes'.In 2010, Washington imposed sanctions on Office 39, a covert bureau of the ruling Workers’ Party, that it alleged managed funds for the leadership and raised money partly through drug trafficking. Insurance claims have also been a source of illicit revenue.But in recent years, Kim has shifted his regime's focus to the opportunities presented by cyber crime.The country's cyber thieves made international headlines with the hacking of Sony Pictures in 2014, which was widely understood as retaliation for the studio’s release of The Interview, a comedy depicting a fictional plot to assassinate the supreme leader.In 2016, hackers stole $81mn from Bangladesh’s central bank in an attack US prosecutors blamed on North Korea.Bitcoin and cryptocurrency exchanges, with their ability to generate vast and untraceable profits, have also attracted the regime's interest. The North Korean state-backed Lazarus Group hacking syndicate was in 2022 accused of stealing approximately $620mn in digital assets from the Ronin network, which underpinned a blockchain-based video game.Two years later, TraderTraitor — allegedly part of Lazarus — stole $308mn from Japanese crypto exchange DMM Bitcoin, according to US and Japanese investigators.It came after the group tricked an employee at a digital wallet company into downloading malicious software.TraderTraitor is the same organisation accused of carrying out Thursday's hack of Binance.In February 2025, North Korean hackers pocketed about $1.5bn from the Dubai-based cryptocurrency exchange Bybit, according to the FBI.The attack was the largest crypto theft on record until the reported Binance attack. Pyongyang has in the past denied that it is involved in cyber crimes, dubbing such accusations 'absurd slander'.In recent years, the state has secretly secured remote jobs for North Koreans, who transfer their salaries to the regime and in some cases use their network access to aid hacks.According to the US Department of Justice, North Korean hackers posing as remote workers infiltrated over 300 US companies between 2020 and 2024, generating at least $6.8mn for Pyongyang. The revenue from such thefts goes towards funding the regime's military ambitions, experts said.In a March 2024 report, UN sanctions monitors revealed they were investigating 58 suspected North Korean attacks on cryptocurrency-related companies between 2017 and 2023, valued at about $3bn.The proceeds allegedly helped finance weapons development.With the development of AI, which helps hackers to identify vulnerabilities and automate attempts to exploit them, the risks are likely to only increase, warned Choi.'AI has given hackers wings,' he added. 'The gates of hell have opened because North Korea has such a strong determination to carry out these attacks.' The revenue from cyber warfare goes towards funding the regime's military ambitions, experts saidFollowing the hacking of Binance, cryptocurrency prices fell.Binance said it would use company funds to cover the losses. Stablecoin issuers including ‌El Salvador-based Tether and the Trump-backed World Liberty Financial froze about half of the stolen assets.'This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,' Binance said in a post on X.The exchange said customer funds were safe and it was working with partners to freeze some of the affected assets, with about $3 billion located so far. It said earlier on Friday it expected to ​resume withdrawal services in the next 48 hours. It did not mention the status of the remaining $3.3 billion.Binance said the company had set aside around $6.34 billion of company funds internally to cover the losses, without giving details ​about where the funds had come from. The company has a $1 billion bitcoin reserve fund designed to protect customer assets in the event of security breaches, according to its website. ⁠Binance founder Changpeng Zhao said on X that the company owned SpaceX shares worth more than $1 billion.TRM said the attackers were able to order Binance wallets to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the FBI attributed to North Korea.'TRM attributes the attack to... ​North Korea's elite hacking unit,' the firm said in an analysis posted on its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible.British blockchain analysts Elliptic also said they believed North Korea was behind the theft. 'This incident is almost certainly the single largest known theft of any kind,' Elliptic said.'Your money is safe and we're covering every loss,' Binance co-CEO Richard Teng said on X. 'Our investigation has not attributed responsibility to any individual.''It's ‌the biggest hack ⁠in history,' Aravind Srinivasan at market maker GSR said, as crypto prices fell broadly.Bitcoin hit a six-week low of $76,368 and ether fell more than 3 per cent to a two-month low of $2,178 before markets stabilised.BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5.3 per cent over the past 24 hours at $699.54, according to CoinGecko, while shaky confidence hit listed crypto exchange shares.'Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,' Binance said. ​The company later added it had uncovered additional points of ​breach.Beyond the potential loss of assets, the security breach ⁠was likely to have wider ramifications for the crypto sector, which had already been under pressure due to higher US interest rates and softer demand from exchange-traded fund buyers, analysts said.'It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,' said Tim Sun, senior researcher at HashKey Group.