North Korea crypto hackers: how the regime trains them from school

Blockchain analysts have attributed the attack on the Binance crypto exchange to the hacker group TraderTraitor, which governments and researchers link to North Korea. According to their findings, Pyongyang is also behind attacks on banks, other crypto exchanges and blockchain platforms, and for a country under international sanctions, cyberattacks have become one of the main ways to earn foreign currency.

Why North Korean hackers can’t be stopped

An ordinary cybercriminal is often undone by a single mistake. “In the world of cybercrime, a single mistake is often enough for the police to catch you,” says Alec Zebrik of Chainalysis, a company that analyzes cryptocurrency flows.

North Koreans, he says, are practically untouchable. “These are state-backed hackers, and they do it for the regime. So they will carry on, even after setbacks, because it is very hard for the international community to take action against them,” Zebrik explains.

Zebrik cannot say with certainty whether artificial intelligence helped the hackers in the Binance attack. But North Korean cybercriminals, he says, use AI in their campaigns “quite effectively.”

Money is also raised outside the country: programmers abroad use fake identities to find remote jobs at other companies’ expense. American and South Korean officials, as well as UN officials, agree on this. Pyongyang itself has long denied any involvement in cyber break-ins, calling the accusations a politically motivated fabrication. It also rejects responsibility for the Binance case.

Talent is picked out at school

According to researchers and defectors from North Korea, the regime selects the most capable students as early as middle school age. The best end up in the army’s cyber units, while the rest are prepared for work abroad.

“There are very few fields where you can earn that much money. That’s why many smart young North Korean men and women want to study IT and become programmers,” says Nam Bada, director of the human rights organization PSCORE in Seoul.

The regime rewards the elite with bonuses in foreign currency, the best housing in Pyongyang and the chance of a career. But for most rank-and-file programmers, the work is neither profitable nor voluntary.

Income quotas and life abroad

Every team has a monthly quota for how much it must earn. “The quota has to be met at any cost. At the end or at the beginning of the month, the money must reach the boss’s account, otherwise the quota doesn’t count,” Nam Bada describes. “If they fail, they face various punishments and humiliations.”

To get better internet access, the regime sends them abroad. “It seems they have expanded to China, Russia and Southeast Asia, and now to Africa and Mongolia as well,” Nam says.

But even there they don’t live freely. “They live and work only among themselves, in designated places,” the PSCORE director says. “They usually work 12 to 16 hours a day, and sometimes up to 19. There are practically no days off.”

Around Prague, based on reporting by seznamzpravy.cz