How hacking became a key weapon for sanctions-hit North Korea

How hacking became a key weapon for sanctions-hit North Korea The US$6.3 billion stolen in the Binance crypto theft is equivalent to about one-sixth of North Korea's annual national income, according to an analyst. SEOUL: The recent US$6.3 billion Binance cryptocurrency theft, which the United States’ Federal Bureau of Investigation (FBI) has blamed on North Korea, has drawn fresh attention to the country's cyber capabilities and their growing importance to Pyongyang. Analysts say North Korea has spent years systematically building its hacking operations, gaining a reputation as a major force in global cybercrime. "You could say North Korea is good at choosing what to focus on," said Lee Ho-ryung, a senior research fellow at the Korea Institute for Defense Analyses (KIDA). "In hacking, it's number one. You can see that as having invested heavily in illegal theft." Lee added: "They (North Korea) select children gifted in math and science early and have them study intensively in hacking and code-breaking, this kind of illegal work." Some are later sent to study in China or Russia, before going on to serve in cyber units linked to the military, state institutions and the ruling Workers' Party of Korea. Pyongyang reorganised its hacking units earlier this year, expanding its top intelligency agency, the Reconnaissance General Bureau, and giving it more cyber capabilities. Hacking is also carried out by the country's Munitions Industry Department, which oversees weapons production. South Korea's military estimates North Korea's cyber force now numbers about 8,400 personnel, an increase of around 20 per cent in just two years. WHY HACKING PAYS OFF For North Korea, hacking offers something international sanctions have made increasingly difficult to obtain: money. Pyongyang has denied involvement in the Binance hack, the biggest cryptocurrency heist in history. KIDA’s Lee, however, estimates the US$6.3 billion that was stolen is equivalent to roughly one-sixth of North Korea's annual national income. He also noted that North Korea's exports last year were only around US$420 million to US$430 million. Binance has since said it has replaced 90 per cent of the amount stolen and it is "committed to covering the remaining 10 per cent". The crypto exchange has also vowed that users will not bear the financial impact of the incident. Analysts say such cyber thefts could be helping to fund North Korea's weapons programmes. The country remains under multiple international sanctions over its nuclear and ballistic missile activities, limiting its ability to acquire materials and technology through conventional channels. "To make those, North Korea doesn't have all the parts," Lee said, referring to weapons systems. "It has to buy the parts, make the weapons and build factories. So how did it cover those costs? In the end, it would have been with money that came in through financial theft." A multinational sanctions monitoring report that was published in October 2025 found that North Korea launders stolen crypto before converting it into cash through overseas brokers in countries including China, Russia and Cambodia. THREAT TO SOUTH KOREA South Korea's intelligence agency has said most hacking attempts targeting the country's public sector originate from the North. North and South Korea remain technically at war, with no peace treaty signed since the 1950–1953 Korean War. Relations between the neighbours remain deeply tense. Earlier this year, South Korean President Lee Jae Myung called for the creation of a powerful new body to coordinate the country’s cyber defences. "North Korea's illegal cyber activities are not only a major source of funding for its nuclear and missile programmes, but also a threat to the global digital economy," South Korean foreign ministry spokesperson Park Doosoon said. Park added that Seoul has responded to Pyongyang’s cyber activities through various measures, including working groups involving the US and Japan.