North Korea’s crypto hackers are not self-taught operators working on their own, according to a BlockTempo report. The article describes a state-run talent pipeline that starts in primary school, moves top students into elite computer programs in Pyongyang, then channels them through leading universities and military schools before assigning them to hacking units tied to the Reconnaissance General Bureau. In recent years, the report says, cryptocurrency has become one of their preferred targets.
The report points to Binance’s latest hack as a possible example. It says the exchange suffered a $6.3 billion theft, which it describes as the largest crypto heist on record. Blockchain security firm TRM Labs said TraderTraitor, often grouped under the Lazarus umbrella as a branch focused on stealing crypto, was a highly likely suspect. Chainalysis CEO Jonathan Levin also wrote on X that TraderTraitor was likely responsible. As of the afternoon of Oct. 30, however, neither Binance nor the FBI had formally named North Korea, so the attribution had not been officially confirmed.
Selection starts early and runs through elite schools in Pyongyang
The report says most North Korean households do not have internet access, and many do not have computers at all, which means hacking talent is cultivated through state selection rather than broad public access to technology. Martyn Williams, editor of North Korea Tech, told NBC that math and science are emphasized from primary school. Only the strongest students get access to computers, then move into specialized programming schools, compete in national contests, and, if they continue to rank at the top, advance to elite universities.
Former North Korean computer science professor Kim Heung-kwang, who defected in 2004, gave a more detailed account in 2011. He said gifted students from across the country were gathered into computer prodigy classes at Kumsong No. 1 and No. 2 Middle School in Pyongyang. Top graduates could bring their families to the capital. From there, students moved on to Kim Il Sung University, Kim Chaek University of Technology, and Mirim University. Some were later sent abroad for study, and many were eventually assigned to dedicated hacking units.
The military track appears just as structured. Reuters, in a 2014 interview with defector Jang Se-yul, said he had attended the military computer school Command Automation University. Jang said hackers in Bureau 121 under the Reconnaissance General Bureau could be selected as early as age 17. The school runs a five-year program. More than 2,500 people apply each year, and only about 100 graduate.
The incentives are also clear in the report. Students from rural areas who perform well may be able to move their families to Pyongyang. Those assigned to overseas teams may receive large state-provided apartments in high-end districts of the capital. Kim Heung-kwang was quoted in the same report as saying, 「This is a great honor for them. There, it is a white-collar job, and everyone wants it.」
Competitions and universities feed the cyber force
International competitions are described as another route into the system. Ri Jong Yol, who won silver medals at the International Mathematical Olympiad for three straight years, defected in Hong Kong in 2016 on the night before he was scheduled to return home after a competition. Kim Heung-kwang said Ri might otherwise have been assigned to the cyber force.
The report also cites a 2023 online programming contest hosted by U.S.-based HackerEarth. Students from Kim Chaek University of Technology and one student from Kim Il Sung University took the top four spots, and North Korean state television later aired a feature on the result.
About 8,400 state cyber personnel, according to South Korea
The current estimate in the article comes from South Korea’s Cyber Operations Command, which told the National Assembly in October 2024 that North Korea had about 8,400 state-level cyber personnel, mainly under the Reconnaissance General Bureau.
South Korea’s National Intelligence Service told lawmakers that Kim Jong Un had described cyber warfare, nuclear weapons, and missiles as 「all-purpose swords.」 Jang Se-yul put it more bluntly, saying the strongest weapon for them is the internet, and that in North Korea this is called a 「secret war.」
The report also reviews recent attributions. The FBI said the February 2025 Bybit case, involving about $1.5 billion, was the work of TraderTraitor. In the April 2026 Drift case, Drift attributed the attack with medium-high confidence to another North Korean group, UNC4736, also known as AppleJeus. Media outlets often group these units under the broader Lazarus label.
Separately, North Korea-focused outlet Daily NK reported in March 2025, citing an internal source, that Kim Jong Un had ordered the creation of 「Lab 227」 under the Reconnaissance General Bureau to focus on offensive hacking techniques and AI. The BlockTempo report notes that this remains a single-source claim and has not been officially confirmed.
They target people and process, not just code
One of the report’s central points is that these groups often break in through people rather than smart contract flaws. Employee devices and business workflows are frequent entry points.
In the May 2024 theft of about $308 million from Japan’s DMM Bitcoin, the FBI and Japan’s National Police Agency, among others, attributed the attack to TraderTraitor. According to the report, the hackers posed as recruiters on LinkedIn and used a so-called pre-employment test to trick an employee at Ginco, a software vendor managing wallet systems for DMM, into running a malicious script.
In the Bybit case, the entry point was a computer used by a Safe{Wallet} developer. In the Drift case, the report says the attackers spent six months posing as quantitative traders, met contributors face to face at crypto conferences, and even deposited more than $1 million to build trust before cutting contact and launching the attack. In the Binance case, the exchange’s preliminary explanation pointed to a DevOps engineer’s laptop.
The article says this is full-time work backed by state resources. Teams can spend half a year on a single operation and can afford upfront costs that exceed $1 million if that helps them get in.
A separate force poses as remote IT workers
The report also highlights another North Korean channel: IT workers using false identities to apply for overseas remote jobs. On Oct. 28, the U.S. Treasury’s Office of Foreign Assets Control sanctioned people accused of helping those workers cash out earnings. In a blog post published the same day, Chainalysis cited a U.N. panel of experts estimate that these workers are spread across dozens of countries and generate $250 million to $600 million a year for the regime.
BBC interviewed a defector using the alias Jin-su in 2025. He said he earned at least $5,000 a month and sent about 85% of that income to the regime. BBC said it could not independently verify the claim.
Not everyone in the system is elite, the report adds. On-chain investigator ZachXBT exposed a team of 140 fake engineers whose internal ranking site used the password 123456. He said their methods were crude, and that the more serious threat comes from elite groups such as TraderTraitor.
How the money is laundered and where it goes
On scale, the report cites a Chainalysis report from December 2025 estimating that North Korea-linked hackers stole about $2.02 billion in 2025, roughly 60% of the global total of $3.4 billion that year. The cumulative figure across years was put at about $6.75 billion. Chainalysis also said that before the Binance case in 2026, incidents including Drift and Bitget had already pushed North Korea’s annual stolen total above $1 billion.
Cashing out depends on a laundering network. Chainalysis said the process often runs on a roughly 45-day cycle and makes heavy use of Chinese-language underground money-laundering networks. After the U.N. panel of experts was dissolved following a Russian veto, an 11-country Multilateral Sanctions Monitoring Team, or MSMT, published a report in October 2025 naming Cambodia-based Huione as a laundering channel used by North Korea.
As for where the proceeds end up, the report cites a March 2024 U.N. panel of experts report saying cyber activity accounts for about half of North Korea’s foreign currency income. The article’s framing is direct: stolen crypto is seen as one of the funding sources supporting Kim Jong Un’s nuclear weapons program.
