North Korea’s Secret Weapon: How Kim Jong Un Turns Schoolchildren Into World-Class Hackers

North Korea has built one of the most feared hacking forces in the world — and it starts in the classroom. A Reuters investigation published on 6 November 2026 reveals that the country picks around 200 of its smartest middle-school children every year, some as young as 11, and trains them to become elite computer hackers for the state.

The programme has been running for more than a decade. Its graduates are now blamed for the biggest cyber heist in history: the theft of $6.3 billion from the cryptocurrency exchange Binance in October 2026. The FBI and Binance say North Korea was behind the attack. Pyongyang denies it.

This is how a poor, isolated country with limited internet access built a hacking army that worries governments and banks around the world — and what it tells us about the future of cybercrime.

How North Korea Picks Its Hackers

The selection process starts early. According to defectors and analysts who spoke to Reuters, North Korean officials visit middle schools and pick about 150 to 200 of the brightest children each year to study computer science. Some are only 11 or 12 years old.

“There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives,” said Kim Heung-kwang, a North Korean defector who trained hackers for the state before fleeing to South Korea in 2004. “Whether they want to be a hacker or not does not matter.”

The chosen children are sent to special schools to study computer engineering. At the age of 17, the best students move on to North Korea’s top universities. There they face more tests and screening. Only a small number of the very best are finally accepted into the military’s cyber unit as hackers.

The rest are not wasted. Those who do not become hackers are trained to work in remote technology jobs for Western companies, earning money for the regime. People who have dealt with these workers describe them as highly organised, polite — and heavy users of artificial intelligence tools such as ChatGPT, Claude Code and Cursor to write code, polish CVs and even forge documents and identities.

The system is deliberate. “While South Korea’s best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future,” said Lim Jongin, professor emeritus at the school of cybersecurity at Korea University in Seoul.

The Rewards: Flats, Cash and a Place in the Elite

For the few who make it to the top, the rewards are extraordinary by North Korean standards. Top hackers are given a spacious apartment in the capital, Pyongyang — some as large as 132 square metres (1,420 square feet) — where their parents can also live. In a country where most people live in cramped housing and struggle for basics, a large flat in the capital is a life-changing prize.

There is money too. Successful hacking operations can earn the hackers’ military unit as much as 30% of the profits from a heist, paid in US dollars. Individual hackers receive large cash awards in hard currency. They can also win membership of the ruling Workers’ Party and marriages into elite families. Some are allowed to travel abroad to friendly countries such as China, where they can access the internet more freely.

“They are actually one of Kim Jong Un’s secret weapons,” said Kim Heung-kwang, the former state trainer.

North Korea does not publicly celebrate its hackers. State media never praises a successful cyber theft. But it regularly highlights school students who show talent in programming, and the hackers’ formal job titles inside the system are “scientist” or “researcher”. In 2015, North Korea opened Mirae Scientists Street in Pyongyang, a new district of tower blocks for scientists — a project Kim Jong Un was closely involved in.

A Programme Built Over Decades

North Korea set up its first cyber unit in 1998. But the programme only became a top priority after Kim Jong Un came to power. In 2013, Kim declared that cyber warfare was, along with nuclear weapons and missiles, an “all-purpose sword” crucial to the country’s ability to strike back at its enemies.

That decision shaped everything that followed. South Korea’s National Intelligence Service estimated in 2024 that about 8,400 people work in North Korea’s cyber operations. It is a large, organised workforce, run like a military unit, with strict hours, discipline and targets.

In the early days, the group ran illegal gambling websites to make money. Over the years, it moved on to bigger and more ambitious targets: banks, cryptocurrency exchanges and financial companies. The skills were built up slowly, operation by operation, with the state protecting its hackers from any consequences.

“State backing makes the North’s hackers more dangerous and harder to repulse, as they face no consequences for hack after hack, enabling them to perfect their strategies,” analysts told Reuters.

“In the world of cyber crime, often, if you make a mistake … that is all law enforcement needs to get you,” said Alec Zebrick, senior manager for Asia-Pacific global services at the blockchain analysis firm Chainalysis. “But North Korea’s hackers are doing this for the regime, so they’re going to continue, even after successes. Even after failures, they’ll continue, because it’s very hard for the international community to take action against them.”

The $6.3 Billion Binance Heist

The programme’s biggest success — and its biggest test — came in October 2026, when attackers drained about $6.3 billion from Binance, the world’s largest cryptocurrency exchange. It was the largest cyber theft ever recorded.

The FBI and Binance have blamed North Korea for the attack. Blockchain investigation firms have attributed it to a North Korean hacking group known as “TraderTraitor”, which the FBI says is affiliated with the Lazarus Group, also known as APT38. Pyongyang has denied any involvement, calling the accusations fabricated political provocations.

According to Binance, the attackers did not break in through brute force. They used a fake job interview and software hidden inside an advertisement to get onto staff computers. Once inside, they used one of Binance’s own internal artificial intelligence tools to take control of its systems.

The same group had already been linked to earlier thefts. The Lazarus Group was accused by the United States in 2022 of stealing hundreds of millions of dollars’ worth of cryptocurrency from the Ronin blockchain network, which powers a popular online game.

The use of AI is now central to how the group works. In 2025, a sanctions monitoring team made up of members from 11 United Nations countries reported that TraderTraitor had obtained both ChatGPT and DeepSeek accounts. The hackers use AI to write code, build fake identities and move faster than their targets can react.

Binance later said it had recovered 98% of the stolen funds, but the scale of the attempted theft shocked the financial world. It showed that a state-backed hacking team could take on the biggest name in crypto — and nearly get away with it. For background on the theft itself, see our earlier reports on the Binance hack and Binance’s recovery of the funds.

Why State Backing Makes Them So Dangerous

Most cybercriminals work alone or in small gangs. They worry about being caught, arrested and jailed. North Korea’s hackers do not have that fear. They work for the state, inside a country that will not hand them over to foreign police. Every failed attack is a lesson, not a risk. Every success brings rewards.

That freedom is what makes them so hard to stop. They can try again and again, improving their methods each time, while their targets — banks, exchanges and companies — must defend themselves perfectly every single day.

Analysts say the group is now aiming even higher. “We see more and more of them leaning towards what we call ‘big game hunting’,” said Zebrick of Chainalysis. “So they’re targeting some of these larger organisations, potentially have larger vaults of funds, that they could potentially get. These are harder targets. However, as we can see with the Binance case, the payout certainly can make it worth their time.”

The hackers are also getting better at hiding. They use fake identities, remote IT jobs and AI tools to blend in with ordinary technology workers. Some North Korean IT workers take real jobs at Western companies under false identities, earning salaries that are sent back to the regime. Others pose as job seekers or recruiters to trick employees into opening malicious files — exactly the trick used in the Binance attack.

The Human Cost Behind the Hacking Machine

For all the talk of rewards, life as a North Korean hacker or IT worker is gruelling, according to former workers and human rights groups. A report last year by the advocacy group PSCORE (People for Successful Corean Reunification) described cramped living spaces, working days longer than 10 hours, constant surveillance and strict targets.

“There is always pressure to keep earning money,” said Nam Bada, the group’s executive director. “The stress is extreme, and because of the psychological strain people develop health problems they didn’t have before.”

IT workers must meet a monthly earnings target in US dollars, or face humiliation and other punishments, he said.

And for the children picked at 11 or 12, there is no choice in the matter. The state decides their future. As Kim Heung-kwang put it: whether they want to be a hacker or not does not matter.

What Happens Next

The Reuters investigation suggests North Korea’s hacking programme will only grow more ambitious. The Binance heist showed the world what the programme can do — and the rewards on offer will keep attracting the country’s brightest young minds into it.

For governments and companies, the challenge is clear. A hacking force of around 8,400 people, trained from childhood, protected by the state and now armed with artificial intelligence, is not going away. The defences of banks, exchanges and technology companies will have to keep improving just to stay level.

For the rest of the world, the story is a reminder that cybercrime is no longer just the work of lone criminals in basements. It is now a state-run industry — and in North Korea, it starts with a child in a classroom being told they are among the smartest in the country, and that their future belongs to the regime.

Frequently asked questions

How does North Korea recruit hackers?

Officials select about 150 to 200 of the brightest middle-school students each year, some as young as 11 or 12, to study computer science. The best students go to top universities at 17, and a small number are chosen for the military’s cyber unit.

How many people work in North Korea’s cyber operations?

South Korea’s National Intelligence Service estimated in 2024 that about 8,400 people are involved in North Korea’s cyberwarfare operations.

What is the Lazarus Group?

The Lazarus Group, also known as APT38, is a hacking group linked to North Korea. The United States accused it in 2022 of stealing hundreds of millions of dollars from the Ronin blockchain network. The FBI says the group behind the Binance hack, TraderTraitor, is affiliated with Lazarus.

Was North Korea behind the Binance hack?

The FBI and Binance have said North Korea was responsible for the $6.3 billion theft from Binance in October 2026. Blockchain investigators attribute the attack to the North Korean-linked group TraderTraitor. Pyongyang denies any involvement.

What rewards do North Korea’s top hackers receive?

Successful hackers can receive a large apartment in Pyongyang of up to 132 square metres, big cash awards in US dollars, membership of the ruling party, marriages into elite families, and travel abroad. Their military unit can earn up to 30% of a heist’s profits.

When did North Korea start its cyber programme?

North Korea set up its first cyber unit in 1998. Leader Kim Jong Un raised its importance after coming to power, declaring in 2013 that cyber warfare was an “all-purpose sword” alongside nuclear weapons and missiles.

Conclusion

North Korea’s hacker army did not appear overnight. It is the result of a system built over more than a decade: children spotted at school, trained for years, rewarded with flats and cash, and protected by the state no matter what they do. The $6.3 billion Binance heist was the programme’s most dramatic result so far — but analysts expect the group to keep aiming higher. For the rest of the world, the lesson is that the most dangerous hackers today may not be criminals hiding from the law. They may be employees of a government that treats cyber theft as a national industry.

Sources

• Reuters investigation, “North Korea’s army of world-class hackers is secret weapon that took down Binance” (6 November 2026), via SRN News: https://srnnews.com/north-koreas-army-of-world-class-hackers-is-secret-weapon-that-took-down-binance/
• Reuters investigation, same report, via BusinessWorld Online: https://bworldonline.com/technology/2026/11/06/792021/north-koreas-army-of-world-class-hackers-is-secret-weapon-that-took-down-binance/
• Reuters investigation, same report, via 98.5 The River: https://985theriver.com/2026/11/06/north-koreas-army-of-world-class-hackers-is-secret-weapon-that-took-down-binance/

This article is for general information and education only. It is not legal or financial advice.