Recruiting Children, Stealing Billions: How Kim Jong Un Built the World's Strongest Cyber Army

North Korea has transformed into a global force in electronic piracy after leader Kim Jong Un's regime successfully built an army of hackers trained at the highest levels.

Through a government program aimed at identifying the smartest children and directing them toward cybersecurity work from an early age, Pyongyang began generating massive financial returns with this strategy, the latest being the hack of the cryptocurrency platform Binance; resulting in the theft of $6.3 billion, according to Reuters.

Pyongyang relies on an integrated system for selecting and training technical talent, offering material and social privileges to top performers, including large apartments in the capital and significant rewards in foreign currency, along with opportunities to travel abroad and join the ruling party, in exchange for long working hours and continuous pressure to meet specific financial targets.

Kim Hyung Kwang, a North Korean defector who previously trained state hackers before fleeing to South Korea in 2004, said these intruders represent one of Kim Jong Un's secret weapons, explaining that authorities do not merely train those willing to work in this field but systematically seek out the most intelligent children to turn them into specialists in electronic operations.

He added that North Korea follows a different approach than other countries in preparing hackers, as choosing this path is not necessarily a personal decision for students but part of a government system investing in young talent to serve state objectives.

Program to Discover Hackers Since Childhood
According to Kim and other defectors who worked in the IT sector, the selection process begins when candidates are between 11 and 12 years old, as authorities annually choose between 150 and 200 of the smartest middle school students to study computer science.

Upon reaching age 17, outstanding students are sent to the country's best universities, where they undergo additional stages of evaluation and selection, before a limited number join the military's cybersecurity unit.

Selected individuals receive specialized training including cryptocurrency protocols and reverse engineering of foreign devices, alongside advanced mathematics and foreign languages. Those who do not join hacking units are sometimes directed toward software and application development or remote work for Western companies.

Lim Jong-in, honorary professor at the College of Cyber Security at Korea University, said Pyongyang directs its best talents to nuclear and cyber programs, providing them with a distinguished professional future, instead of top students in South Korea heading toward medicine and traditional prestigious professions.

The roots of the electronic program date back to 1998, but it gained greater importance after Kim Jong Un came to power, when North Korea declared in 2013 that cyber warfare, alongside nuclear weapons and missiles, represents a multi-purpose sword for its offensive capabilities.

Huge Rewards for Theft Operations
Information reported by Reuters indicates that successful hackers may receive up to 30% of the profits from their units' theft operations in foreign currency, plus the possibility of being granted apartments in Pyongyang up to 132 square meters in size, where their parents can reside.

Privileges also include the ability to travel to allied countries such as China, where they have greater freedom to use the internet, as well as opportunities to obtain membership in the ruling party and marry into prestigious families.

South Korea's National Intelligence Service estimates that North Korean cyber warfare operations involve approximately 8,400 people, while official media avoids publicly celebrating hackers' achievements, limiting itself to highlighting talented programming students, including participants in developing the country's technical capabilities.

The US Federal Bureau of Investigation and Binance announced North Korea's responsibility for the platform breach, while Pyongyang denied the accusations. Specialized blockchain analysis firms attributed the operation to the North Korean hacking group known as TraderTraitor.

This group is linked, according to the FBI, to the Lazarus Group, also known as APT38, which the United States accused in 2022 of stealing hundreds of millions of dollars in cryptocurrencies via the Ronin blockchain network.

Binance revealed that hackers used a fake job interview and malicious software hidden within an advertisement to compromise company employees' devices, before employing an internal artificial intelligence tool to take control of systems.

A UN report issued in 2025 also indicated that the TraderTraitor group obtained accounts on ChatGPT and DeepSeek platforms.

Groups of North Korean technical workers use AI tools to write code, modify resumes, and create fake identities and documents, aiming to secure remote jobs within Western companies and transfer their earnings to the regime.

Artificial Intelligence and Hunting Big Targets
Alex Zeibrik, First Director of Global Services for Asia-Pacific at Chainalysis, said government support gives North Korean hackers greater ability to continue attacks without facing usual consequences, explaining that their connection to the regime makes them persist in operations even after failures.

In contrast, testimonies from former workers, reported by the human rights group PSCORE, reveal harsh working conditions including more than ten hours of daily work, residence in cramped spaces, constant surveillance, and pressure to meet specific monthly dollar targets, with humiliation and punishment for failing to meet them.

Despite these conditions, analysts believe that the success of major operations, such as the Binance hack, may push Pyongyang to expand its ambitions, shifting toward targeting major institutions with huge financial reserves, a shift reflecting the rising role of cyber piracy as an economic and strategic tool for the North Korean regime.