A Reuters investigation published on Friday described how North Korea has developed a specialised cyber workforce through a programme that identifies academically gifted students and directs a select number towards military hacking units. Defectors and analysts interviewed by Reuters said the programme has operated for more than a decade, with approximately 150 to 200 students selected annually for advanced computing education.
The investigation follows the major Binance security breach, which the US Federal Bureau of Investigation and the cryptocurrency exchange have attributed to North Korea. Blockchain investigation firms have linked the operation to TraderTraitor, a hacking group associated with the Lazarus network. Pyongyang has denied responsibility.
According to Reuters, the recruitment programme begins at an early age, with selected students receiving specialised education in computer science, mathematics, foreign languages and other technical disciplines. Those who progress through further screening may enter military cyber units, while others are directed towards overseas information technology work that can generate revenue for the state.
The incentives reportedly offered to successful operatives include financial rewards, accommodation in Pyongyang and access to privileges associated with the country's elite. However, former workers and human rights advocates have also described demanding conditions, including long working hours, surveillance and strict earnings targets.
The scale of the operation is significant. South Korea's National Intelligence Service estimated that North Korea's cyber operations employed about 8,400 people in 2024. The workforce combines offensive cyber capabilities with overseas IT activity, which analysts say can provide income while creating opportunities for fraudulent access to foreign companies.
Artificial intelligence is adding another dimension to the threat. Sources cited by Reuters said North Korean IT workers use AI tools to write code, prepare job applications and create false identities. Binance also said attackers used a fraudulent job interview and malicious software to compromise staff computers before exploiting an internal AI tool during the breach.
The incident raises concerns beyond cryptocurrency markets. Successful cyberattacks can undermine confidence in digital financial infrastructure, expose sensitive information and create risks for businesses that rely on interconnected technology systems.
For exchanges and financial institutions, priorities include stronger identity verification, employee security training, access controls, and monitoring of internal systems. International investigators will also need to strengthen cooperation on tracing stolen digital assets and identifying the networks responsible.
The Binance case reinforces the importance of treating state-linked cybercrime as a financial and national-security risk. Further evidence about the stolen funds, the attackers' methods, and the international response will determine how effectively the industry can contain similar threats.
