[Coin Crime] How North Korea Became a ‘Hacking Power’ Since the 1980s

[By Yang Won-mo, Block Media] In September, an engineer at the global digital asset exchange Binance received a job offer. After a video interview, the interviewer handed over a development task. It seemed like a perfectly normal procedure—until hidden malware was discovered in the task file.

On October 29 (local time), approximately $6.34 billion worth of digital assets were unlawfully withdrawn from Binance's wallet. It was the largest digital asset hacking incident in history. Two days later, the FBI identified the North Korean hacking group 'TraderTraitor' as the culprit.

How did North Korea, one of the most closed-off countries in the world, manage to breach the security of the largest digital asset exchange? The background lies in a decades-long strategy of nurturing talent at the national level and developing hacking as a means of earning foreign currency.

From Math Prodigies to Hackers... The 'Cyber Army' Established Since the 1980s

North Korea's hacking history predates the birth of Bitcoin by a significant margin. The key is that cyber attacks have been developed not as 'individual criminal activities' but as 'strategic capabilities at the national level.'

Since the 1980s, North Korea has been training specialized personnel in cyber warfare. Established in 1986, 'Mirim University' is considered North Korea's leading hacking training institution. Unlike conventional weapons that require massive capital, cyber warfare can inflict damage on foreign financial and information systems with minimal personnel and costs. This was a so-called 'cost-effective' strategy for economically struggling North Korea.

In the 1990s, North Korea established a system to select outstanding students in mathematics and science for intensive computer education. According to an analysis by the American security firm DTEX, students at Kim Il-sung Secondary School receive about 1,660 hours of computer education over six years. The curriculum includes programming, operating systems, networks, and even artificial intelligence (AI). Among them, the top talents advance to Kim Il-sung University and Kim Chaek University of Technology to build their expertise.

These trained personnel are deployed to the military, intelligence agencies, and overseas IT organizations. Notable examples include Lazarus and APT38, which are known to be affiliated with the Reconnaissance General Bureau. Our military estimates that North Korea's cyber warfare personnel could reach 8,400 by 2024, including hackers and technical support staff.

From Attacking Film Studios to Targeting International Financial Networks

In its early days, North Korea's cyber attacks focused on information theft and system destruction. A representative case is the hacking of Sony Pictures Entertainment in 2014. Amid the conflict surrounding the film 'The Interview,' which satirized the North Korean leader, internal documents were leaked, and the computer system was paralyzed. The U.S. government attributed the attack to North Korea.

The shift to directly targeting financial gain began with the 2016 hacking of the Bangladesh Central Bank. The attackers exploited the bank's system connected to the SWIFT network to siphon off $81 million. In 2017, the ransomware attack 'WannaCry' paralyzed computers worldwide. The U.S. Department of Justice concluded that North Korean-linked hackers were involved in the Sony hack, the Bangladesh bank incident, and WannaCry.

During its rise to infamy as a hacking nation, North Korea discovered a new target: digital assets. While siphoning off bank funds requires navigating complex international payment networks and scrutiny from financial institutions, digital assets can be moved across borders in large amounts by seizing control of exchange wallets or asset transfer permissions. This represented a new avenue for North Korea to secure foreign currency.

Subsequently, North Korea focused on hacking exchanges and blockchain infrastructure, viewing digital assets as a key target. The FBI identified North Korea's Lazarus and APT38 as responsible for the theft of approximately $620 million from the Ronin Bridge of the blockchain game 'Axie Infinity' in 2022. In 2025, around $1.5 billion worth of digital assets disappeared due to attacks from North Korean-linked hackers on Bybit.

Breaching 'People' Before Security Systems

North Korean hackers are not only skilled in programming but also excel in social engineering, using human trust to infiltrate security networks. They impersonate recruiters or investors to gain access, hiding malware in files that appear to be normal development tasks, taking control of computers, and targeting transaction approval permissions or internal system access.

In the recent Binance incident, the weak link was human. According to Binance's initial investigation, attackers compromised employees' devices over several months and accessed internal AI tools and wallet management systems. They did not break the encryption of the digital assets themselves but attacked the individuals and systems that had the authority to move the assets. According to blockchain analysis firm TRM Labs, about 88% of the funds stolen in North Korean-linked hacks resulted from breaches of core infrastructure such as private keys and signature systems rather than smart contract code flaws.

Recently, they have also employed methods to infiltrate companies directly, disguising their identities to work remotely for foreign firms. The U.S. Department of Justice revealed that in 2025, North Korean-linked personnel had used false identities to gain employment at over 100 U.S. companies. They earned foreign currency through salaries while also accessing sensitive information and digital assets from some companies.

$12.8 Billion Stolen... Hacking Has Become a 'Foreign Currency Earning Industry' for the State

The reason North Korea is fixated on hacking digital assets ultimately comes down to 'money.' With UN Security Council sanctions limiting exports and overseas financial transactions, cyberspace has emerged as a means to circumvent sanctions and secure foreign currency. In 2025, the Multinational Sanctions Monitoring Team (MSMT) reported that North Korea was cashing in stolen digital assets through intermediaries in China, Russia, Hong Kong, and Cambodia. The international community believes that these illegal profits support North Korea's nuclear and missile development.

The scale of the theft is astronomical. According to TRM Labs, North Korean-linked hackers have stolen approximately $12.8 billion worth of digital assets since 2017. This year alone, they are estimated to have stolen $7.4 billion, accounting for about 85% of the global digital asset hacking losses. John C. Demers, former Assistant Attorney General for National Security at the U.S. Department of Justice, stated, "North Korean operatives use keyboards instead of guns and steal digital asset wallets instead of cash bags, making them the world's best bank robbers."

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.