7
North Korea’s cyber force is under scrutiny after hackers stole 6.3 billion dollars in cryptocurrency from Binance, exposing Pyongyang’s investment in training cyber operatives.
The Federal Bureau of Investigation and Binance attributed the October 29 heist to North Korea. Pyongyang denies responsibility. Investigators linked the operation to TraderTraitor, associated with the Lazarus network.
Binance said attackers spent months compromising employees before reaching systems connected to its wallet infrastructure. The campaign involved tampered software and a fraudulent recruitment process. One engineer downloaded a malicious coding assignment after a job interview.
Attackers later used compromised devices, stolen credentials and an internal artificial intelligence tool to access other systems before initiating unauthorised transfers.
The incident highlights a cyber programme built around early talent selection. Defectors and analysts told Reuters that North Korean authorities identify 150 to 200 students annually, sometimes from age 11 or 12, and direct them towards computer science. At 17, top performers can enter leading universities for training and screening. A small number join military cyber units, while others are channelled into overseas information- technology work that earns revenue for the state.
Training reportedly includes advanced mathematics, foreign languages, cryptocurrency protocols and reverse engineering. Operatives may receive financial rewards and privileges, including apartments in Pyongyang.
Former workers have described surveillance, long hours and strict earnings targets.
South Korea’s National Intelligence Service estimated in 2024 that North Korea’s cyber operations involved about 8,400 personnel. This covers the cyber workforce, not just elite hackers.
Reuters sources described operatives using AI for coding, job applications and fabricated identities. Binance separately said an internal AI tool was involved in the intrusion. This does not prove AI autonomously planned or executed the theft.
For exchanges and technology companies, the case underlines the need for recruitment checks, software controls, device security and restricted access to digital-asset wallets.
The Federal Bureau of Investigation and Binance attributed the October 29 heist to North Korea. Pyongyang denies responsibility. Investigators linked the operation to TraderTraitor, associated with the Lazarus network.
Binance said attackers spent months compromising employees before reaching systems connected to its wallet infrastructure. The campaign involved tampered software and a fraudulent recruitment process. One engineer downloaded a malicious coding assignment after a job interview.
Attackers later used compromised devices, stolen credentials and an internal artificial intelligence tool to access other systems before initiating unauthorised transfers.
The incident highlights a cyber programme built around early talent selection. Defectors and analysts told Reuters that North Korean authorities identify 150 to 200 students annually, sometimes from age 11 or 12, and direct them towards computer science. At 17, top performers can enter leading universities for training and screening. A small number join military cyber units, while others are channelled into overseas information- technology work that earns revenue for the state.
Training reportedly includes advanced mathematics, foreign languages, cryptocurrency protocols and reverse engineering. Operatives may receive financial rewards and privileges, including apartments in Pyongyang.
Former workers have described surveillance, long hours and strict earnings targets.
South Korea’s National Intelligence Service estimated in 2024 that North Korea’s cyber operations involved about 8,400 personnel. This covers the cyber workforce, not just elite hackers.
Reuters sources described operatives using AI for coding, job applications and fabricated identities. Binance separately said an internal AI tool was involved in the intrusion. This does not prove AI autonomously planned or executed the theft.
For exchanges and technology companies, the case underlines the need for recruitment checks, software controls, device security and restricted access to digital-asset wallets.
