How North Korea became a hacking superpower

{"text":[[{"start":10.72,"text":"With raids on Hollywood studios, Asian central banks and crypto exchanges, the secretive state of North Korea has gained a reputation as home to some of the world’s most fearsome and brazen cyber hackers."}],[{"start":23.02,"text":"That notoriety will only be reinforced by their alleged involvement in the $6.3bn hack of Binance this week, which is believed to be the world’s biggest-ever crypto theft."}],[{"start":34.68,"text":"Attackers linked by analysts to Pyongyang may have swiped close to double the total amount of crypto stolen worldwide last year — a sum equivalent to almost a fifth of North Korea’s gross national income."}],[{"start":45.92,"text":"Binance, the world’s largest cryptocurrency exchange, has suspended all withdrawals and deposits. It said an “initial investigation” showed hackers had managed to compromise an engineer’s laptop and withdraw funds from the platform."}],[{"start":59.96,"text":"“North Korean hackers are among the world’s most aggressive and highly skilled cyber actors,” Shin Beom-chul, South Korea’s former vice-defence minister, told the FT. “They receive systematic training and are deployed to generate foreign currency for the regime.”"}],[{"start":74.72,"text":"North Korea’s economy has been boosted in recent years by closer ties with Russia, which Pyongyang has supplied with weapons and troops to support Moscow’s war in Ukraine in exchange for billions of dollars in cash, fuel and payments in kind."}],[{"start":null,"text":"

"}],[{"start":89.16,"text":"But the cash-strapped state, which is cut off by sanctions, still resorts to criminal activity to support itself. Last year alone, North Korean hackers stole about $2bn, roughly 60 per cent of the global total and 51 per cent more than they took in 2024, according to blockchain analytics firm Chainalysis."}],[{"start":109.48,"text":"Alongside its nuclear programme, Pyongyang has invested heavily in cyber warfare, setting up a system that identifies and cultivates technical talent from an early age — all with a view towards forging a crack team of hackers to extract income for the state."}],[{"start":123.72,"text":"North Korea is estimated to have about 8,400 personnel involved in cyber warfare operations, according to South Korea’s National Intelligence Service, although the figure includes technical support staff and is not limited to professional hackers."}],[{"start":137.84,"text":"Selected students receive three to five years of advanced technical and cyber warfare training at institutions in North Korea, with the top performers progressing to specialist university programmes, according to North Korean experts."}],[{"start":150.28,"text":"A report this year from the Committee for Human Rights in North Korea referred to a five-year course at Pyongyang’s elite Moranbong College, which combines military studies with hacking and code-breaking."}],[{"start":161.52,"text":"Some elite operatives reportedly go on to receive additional training overseas in China and Russia."}],[{"start":166.92,"text":"“North Korean students who excel in mathematics and science are selected and trained in hacking from their teenage years,” said Simon Choi, chief technology officer at cyber security start-up StealthMole."}],[{"start":179.64,"text":"Since North Korea’s hackers operate on behalf of the state, they are able to act without any fear of prosecution, according to experts. Choi said this made them bolder than their overseas counterparts."}],[{"start":190,"text":"“Because they face no accountability at home, they can actively target and hack foreign institutions,” Shin added."}],[{"start":null,"text":""}],[{"start":197.2,"text":"Pyongyang’s dominance in cyber warfare is the natural outgrowth of its long history of criminal schemes on which the regime has relied to generate hard currency."}],[{"start":206.32,"text":"In the early 2000s, US authorities accused North Korea of trafficking drugs as well as producing counterfeit cigarettes and sophisticated fake $100 “supernotes”. In 2010, Washington imposed sanctions on Office 39, a secretive bureau of the ruling Workers’ Party, that it said managed funds for the leadership and raised money partly through drug trafficking. Insurance claims have also been a source of illicit earnings."}],[{"start":232.34,"text":"In recent years, Pyongyang has shifted its focus to the opportunities offered by cyber crime."}],[{"start":237.6,"text":"North Korean hackers shot to global notoriety with the 2014 hack of Sony Pictures, which was widely viewed as retaliation for the studio’s release of The Interview, a comedy depicting a fictional plot to assassinate leader Kim Jong Un. Two years later, hackers stole $81mn from Bangladesh’s central bank, a theft US prosecutors attributed to North Korea."}],[{"start":260.32,"text":"Bitcoin and cryptocurrency exchanges, with their promise of vast and untraceable riches, have also attracted Pyongyang’s interest."}],[{"start":268.12,"text":"In 2022, the North Korean state-backed Lazarus Group hacking syndicate was suspected of stealing roughly $620mn in digital assets from the Ronin network, which underpinned a blockchain-based video game."}],[{"start":280.28,"text":"Two years later, TraderTraitor — the same group accused of carrying out Thursday’s hack of Binance, and which is allegedly part of Lazarus, according to Japan’s National Police Agency — stole $308mn from Japanese crypto exchange DMM Bitcoin, according to US and Japanese investigators, after tricking an employee at a digital wallet company into downloading malicious software."}],[{"start":302.92,"text":"In February 2025, North Korean hackers stole about $1.5bn from the Dubai-based cryptocurrency exchange Bybit, according to the FBI, in what was the largest crypto theft on record until the reported Binance attack. North Korea has in the past denied that it is involved in cyber crimes, calling such accusations “absurd slander”."}],[{"start":323.6,"text":"In recent years, Pyongyang has also covertly secured remote jobs for North Koreans, who pass their salaries on to the regime and in some cases use their network access to facilitate hacks. The US Department of Justice has estimated that North Korean operatives posing as remote workers infiltrated more than 300 US companies between 2020 and 2024, generating at least $6.8mn for Pyongyang."}],[{"start":348.36,"text":"The proceeds of such thefts offer North Korea an increasingly important source of funding for its military ambitions, according to experts."}],[{"start":356.16,"text":"In a March 2024 report, UN sanctions monitors said they were investigating 58 suspected North Korean attacks on cryptocurrency-related companies between 2017 and 2023, valued at about $3bn, whose proceeds reportedly helped finance weapons development."}],[{"start":372.72,"text":"Choi warned that the risks were likely to rise with the adoption of AI, which helped hackers to identify vulnerabilities and automate attempts to exploit them."}],[{"start":381.28,"text":"“AI has given hackers wings,” he said. “The gates of hell have opened because North Korea has such a strong determination to carry out these attacks.”"}],[{"start":390.12,"text":""}]],"url":"https://audio.ftcn.net.cn/album/a_1793430754_8477.mp3"}