Somewhere in North Korea, or perhaps just across its border in a Chinese city, hides a man whose face has been circulating in the FBI's most wanted fugitive files for eight years. In the photograph, he appears with neatly combed black hair and the serious expression of someone posing for an identification document.
His name is Park Jin Hyok. According to his profile, he speaks Korean, English, and Mandarin. For a long time, he moved between North Korea and China, where his profile matched that of many young programmers working for tech companies. But Washington claims that this seemingly ordinary IT professional is actually one of the elite soldiers of Kim Jong-un's digital army.
According to the FBI, his computer skills made him a key player in the clandestine machinery behind the sabotage of Sony Pictures and the WannaCry virus, which paralyzed hospitals, businesses, and administrations worldwide in 2017. Since 2018, U.S. authorities have been searching for him for his involvement in some of the most notorious cyberattacks in recent years.
Park is not alone. In the FBI's wanted posters, other North Koreans with similar biographies appear: engineers and programmers who have turned digital theft into a state profession. A review of FBI files identifies at least 24 North Koreans wanted by U.S. justice in various investigations of cyberattacks, tech fraud, and money laundering.
Park belongs to the Lazarus group, linked to the General Reconnaissance Bureau (RGB), the powerful North Korean military intelligence agency. Alongside him are Jon Chang Hyok, born in 1989 and known by the Chinese aliases Quan Jiang and Alex Jiang, and Kim Il, who used the names Julien Kim and Tony Walker. The three were charged in 2021 with participating in an operation to steal over $1.3 billion. Their repertoire included bank attacks, malware disguised as financial applications, and sophisticated cryptocurrency scams.
A fourth fugitive, Rim Jong Hyok, is accused of participating in ransomware attacks against U.S. hospitals: hijacking their computer systems, demanding ransoms, and using the money to fund espionage operations against military and tech companies. The FBI links him to Andariel, another unit of Pyongyang's intelligence. The U.S. offers up to ten million dollars for information related to cyberattacks led by Rim.
We focus on the North Korean hackers that the FBI has put faces to after the latest demonstration of the power of Kim Jong-un's digital army. On October 29, within hours, hackers drained the cryptocurrency wallets of Binance, the world's largest exchange platform, stealing around $6.4 billion. The FBI attributed the heist to TraderTraitor, another group linked to the North Korean regime, which had already been blamed for the $1.5 billion theft from Bybit in February 2025.
Last week, Kim Yo-Jong, the influential sister of the North Korean dictator, called the FBI's accusations regarding the Binance theft a "serious political provocation" and "absurd rhetoric." In a statement released by the state agency KCNA, she denounced that Washington systematically attempts to discredit North Korea by linking it to major cybercrime operations. "This is not the first time the U.S. has tried to sow misinformation about North Korea in the international community," she asserted. The regime's number two considered the accusations a new example of U.S. "hostile attitude" and warned of Pyongyang's response.
The assault on Binance, considered the largest cryptocurrency theft in history, has once again put this legion of hackers in the spotlight and raised questions about how one of the most isolated countries on the planet has managed to build a machinery capable of challenging the technological and financial giants of the West.
An exclusive investigation published this week by NK News, an Asian newspaper focused on tracking North Korea's activities, reconstructs how Pyongyang turned its IT talent into a global currency-generating industry.
Three former North Korean tech workers provide an insider account of the evolution of this program: how they were recruited, how their international deployment was organized, and how they ended up infiltrating foreign companies to generate income for the regime.
The investigation reveals that this army of clandestine employees did not emerge overnight but is the result of a strategy developed over decades. An analysis published in March by the Center for Strategic and International Studies (CSIS), based in Washington, estimates that North Korean tech workers generated between $350 and $800 million annually in 2024. Its members use falsified resumes, stolen identities, and manipulated interviews to secure remote jobs in foreign companies.
Some operate from China or Russia; others have intermediaries who keep computers running in the U.S. to simulate working from there. Researchers have even detected the use of AI to create professional photographs and pass interviews using deepfake videos. What began as a way to earn salaries in dollars has transformed into a sophisticated international structure that combines covert employment, industrial espionage, extortion, and digital asset theft.
Network Between Korea, China, and Russia
In December 2024, U.S. justice charged another 14 North Koreans working for two companies controlled by Pyongyang: Yanbian Silverstar, based in China, and Volasys Silverstar, operating in Russia. According to the investigation, both structures employed at least 130 programmers, known internally as "cyber warriors."
The hackers secured tech contracts with Western companies using stolen U.S. identities. Some were paid for years without their employers suspecting they were indirectly funding the North Korean regime.
The network is believed to have generated at least $88 million between 2017 and 2023. The organizers even held "socialist competitions" to reward workers who brought in the most money. Some had minimum targets of $10,000 per month. When they accessed sensitive business information, they could supplement their salaries by stealing source codes or threatening to publish trade secrets.
China repeatedly appears in these files. From various border cities, according to U.S. investigations, different networks operate that have used shell companies, financial intermediaries, and international connections to conceal their cyberattacks.
The ultimate goal is always similar: to obtain foreign currency, evade sanctions, and feed Pyongyang's priorities. According to the data platform Chainalysis, hackers linked to North Korea stole around $2.02 billion in cryptocurrencies during 2025.