North Korea's Elite Hacking Program Fuels Regime's Finances

North Korea, facing international sanctions and global isolation, has developed a sophisticated cyber warfare program to generate revenue, according to reports. Dictator Kim Jong Un has established a system designed to identify and train technically gifted individuals from a young age, forging an elite group of hackers to support the regime.

The isolated nation has gained notoriety for its cyber theft operations, targeting entities such as Hollywood studios, central banks, and cryptocurrency exchanges. This reputation was further amplified by an alleged involvement in a recent $6.3 billion hack of the cryptocurrency exchange Binance, which analysts suggest may be the largest financial heist to date. This single event could represent nearly double the total cryptocurrency stolen globally in the previous year and approximately one-fifth of North Korea's gross national income.

Binance confirmed the breach, halting withdrawals and deposits. Initial investigations suggest the attack may have originated from a compromised laptop belonging to one of its engineers, allowing unauthorized access and withdrawals. Blockchain analysis firms TRM Labs and Chainalysis indicated that the attack's methods bore similarities to previous large-scale operations attributed to North Korea.

Shin Beom-chul, South Korea's former vice-defense minister, described North Korean hackers as among the world's most aggressive and skilled cyber actors, receiving systematic training to generate foreign currency for the regime. While North Korea's economy has seen some support from its ties with Moscow, including weapons and troop supplies in exchange for financial and material aid, the country continues to rely on illicit activities for income.

Blockchain analytics firm Chainalysis reported that North Korean hackers stole approximately $2 billion in 2025, accounting for about 60% of the global total for that year. This figure represented a 51% increase from the previous year. As Pyongyang pursues its nuclear program, it has significantly invested in cyber warfare capabilities, cultivating young talent to build a formidable hacking unit.

South Korea's National Intelligence Service estimates that around 8,400 personnel are involved in North Korea's cyber warfare operations, a figure that includes technical support staff. Selected students undergo three to five years of advanced technical and cyber warfare training at institutions nationwide. Top performers are then admitted to specialized university programs. One such program at Pyongyang's Moranbong College combines military studies with hacking and code-breaking. Elite operatives may also receive additional training in China and Russia.

Simon Choi, chief technology officer at cybersecurity startup StealthMole, noted that students excelling in mathematics and science are identified and trained in hacking from their teenage years. Experts suggest that North Korean cyber thieves operate with a sense of impunity, as they act on behalf of the state, enabling them to undertake more daring operations than their counterparts elsewhere.

For years, North Korea has utilized state-linked cyber units for espionage, financial theft, and revenue generation, according to U.S. and South Korean authorities, as well as cybersecurity experts. The regime has historically been accused of engaging in drug trafficking, counterfeit manufacturing, and the creation of sophisticated counterfeit currency. In 2010, the U.S. sanctioned Office 39, a covert bureau of the ruling Workers' Party, alleging it managed funds for the leadership, partly through drug trafficking. Insurance fraud has also been a source of illicit income.

In recent years, Kim Jong Un has increasingly focused on the opportunities presented by cybercrime. Notable past incidents include the 2014 hacking of Sony Pictures, widely seen as retaliation for the film "The Interview," and the 2016 theft of $81 million from Bangladesh's central bank, an attack blamed on North Korea by U.S. prosecutors. The state-backed Lazarus Group hacking syndicate has been accused of stealing approximately $620 million in digital assets from the Ronin network in 2022. More recently, TraderTraitor, allegedly linked to Lazarus, stole $308 million from Japanese crypto exchange DMM Bitcoin after tricking an employee into downloading malicious software. TraderTraitor is also suspected of being behind the Binance hack.

In February 2025, North Korean hackers allegedly stole about $1.5 billion from the Dubai-based cryptocurrency exchange Bybit, an attack that was, at the time, the largest crypto theft on record. Pyongyang has consistently denied involvement in cybercrimes, labeling such accusations as slander.

Furthermore, North Korea has exploited remote work opportunities, with hackers posing as remote employees to infiltrate over 300 U.S. companies between 2020 and 2024, generating at least $6.8 million for the regime, according to the U.S. Department of Justice. The revenue generated from these illicit activities is believed to fund the regime's military development.

A March 2024 report by UN sanctions monitors revealed an investigation into 58 suspected North Korean attacks on cryptocurrency-related companies between 2017 and 2023, valued at approximately $3 billion, with proceeds allegedly contributing to weapons development.

The increasing capabilities of Artificial Intelligence are expected to further enhance the risks associated with North Korean cyber activities. AI can assist hackers in identifying vulnerabilities and automating exploit attempts. Choi warned that AI has amplified hackers' capabilities and that North Korea's strong determination to carry out attacks poses significant challenges.

Following the Binance hack, cryptocurrency prices experienced a decline. Binance announced it would cover the losses using company funds, and stablecoin issuers, including Tether, and World Liberty Financial froze approximately half of the stolen assets. Binance stated that customer funds remained secure and that it was collaborating with law enforcement to freeze affected assets, with about $3 billion traced so far. The exchange expects to resume withdrawal services within 48 hours. Binance has allocated around $6.34 billion of company funds to cover the losses. The company's founder, Changpeng Zhao, indicated that Binance owned over $1 billion in SpaceX shares. Blockchain analysis firms TRM Labs, Chainalysis, and Elliptic have expressed high confidence in attributing the attack to North Korea's elite hacking unit, with Elliptic calling it potentially the single largest known theft of any kind.

The breach at Binance could have broader implications for the cryptocurrency sector, which is already navigating pressures from rising U.S. interest rates and subdued demand from exchange-traded fund buyers. Analysts suggest this incident may further reduce risk appetite and prompt investors to re-evaluate the security of assets held on centralized exchanges.