By Heejin Kim, Kyu-seok Shim, Maggie Grether and Brenda Goh
SEOUL, Nov 6 (Reuters) – North Korea rewards its top hackers, tasked with heists like the Binance crypto hack that netted a cool $6.3 billion, with perks such as a spacious apartment in the capital of Pyongyang and huge hard currency awards, despite gruelling hours of work.
Leader Kim Jong Un has assembled an army of world-class hackers using such incentives in a programme more than a decade old that picks 200 of the smartest middle school students each year to study computer engineering, defectors and analysts say.
A fraction eventually become hackers in an investment that has paid off dramatically, as the group has evolved from the early days when it ran illegal gambling websites to pulling off the world’s biggest cyber heist last month.
“They are actually one of Kim Jong Un’s secret weapons,” said Kim Heung-kwang, a North Korean defector who trained hackers of behalf of the state before fleeing to South Korea in 2004.
“There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives,” he added. “Whether they want to be a hacker or not does not matter.”
The FBI and Binance have said North Korea was responsible for the Binance hack, but Pyongyang has denied that. Blockchain investigation firms have attributed it to a North Korean group known as “TraderTraitor”.
The denial is part of a pattern in which the North dismisses such blame over the years as fabricated political provocations.
SYSTEMIC SELECTION
North Korea set up a cyber unit in 1998 but elevated its status after Kim came to power and declared in 2013 that cyber warfare was, along with nuclear weapons and missiles, an “all purpose sword” crucial to the country’s strike capability.
Candidate selection begins in middle school as early as 11 or 12 years of age, with authorities picking about 150 to 200 children a year to study computer science, said Kim Heung-kwang, the former trainer, and two defectors who worked in IT.
At 17, the top performers are sent to North Korea’s best universities and undergo further screening before a chosen few finally enter the military’s cyber unit as hackers, they added.
They are trained in areas such as cryptocurrency protocols and reverse-engineering foreign hardware devices in addition to more conventional topics such as advanced mathematics and foreign languages, one of them said.
Those who do not become hackers are trained to turn out software or apps for Western firms via remote jobs.
“While South Korea’s best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future,” said Lim Jongin, professor emeritus at the school of cybersecurity at Korea University.
Other privileges on tap for the hackers are travel abroad to allied countries, such as China, where they can more freely access the internet.
Successful exploits can earn as much as 30% of the heist’s profits in US dollars for the hackers’ military unit, and they can even receive a flat in the capital where their parents can also stay, Kim said.
“There are accounts that successful cyber personnel are given apartments in Pyongyang,” Lim said, adding that the flats could range to as much as 132 sq m (1,420 sq ft).
Such performers are also eligible for membership of the ruling party and high-status marriages into elite families, said one of the defectors.
But it is a small group. The North’s cyberwarfare operations employ about 8,400 people, South Korea’s National Intelligence Service estimated in 2024.
North Korean state media do not publicly celebrate such hackers’ achievements, but they regularly highlight students who show talent for programming.
In 2015, North Korea opened the Mirae Scientists Street in the capital, in the construction of which Kim Jong Un had been closely involved, state media said.
Hackers’ formal designation in the North was “scientist” or “researcher”, said one of the defectors.
STATE ADVANTAGE
Other hacking groups associated with North Korea include the Lazarus Group, also known as APT38, which the US accused in 2022 of having stolen hundreds of millions of dollars worth of cryptocurrency from the Ronin blockchain network. The FBI has said TraderTraitor is affiliated to Lazarus.
State backing makes the North’s hackers more dangerous and harder to repulse, as they face no consequences for hack after hack, enabling them to perfect their strategies, analysts said.
“In the world of cyber crime, often, if you make a mistake … that is all law enforcement needs to get you,” said Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis.
But North Korea’s hackers “are doing this for the regime, so they’re going to continue, even after successes,” he added.
“Even after failures, they’ll continue, because it’s very hard for the international community to take action against them.”
Other groups that have engaged with North Korea IT workers who earn funds for the Kim regime by landing remote technology jobs at Western companies describe them as highly organised, polite in their interactions and avid users of AI.
“There clearly was a structure you would see in military. Strict times, cleaning boots, very orderly,” said YouTuber Deeveeaar, who has claimed to have hacked into cameras watching North Korean IT workers at their jobs.
“To say they ‘use a lot of AI’ is an understatement. AI is the very backbone of their operation,” he said, citing use of paid ChatGPT accounts, Claude Code and Cursor, among many AI tools.
“They write code with it, alter their resumes and help make new ones. And even forge documents and identities.”
Binance said the hackers used a bogus job interview and software hidden in an advertisement to compromise staffers’ computers before using an internal AI tool to seize control of systems.
In 2025, a sanctions monitoring team drawn from 11 United Nations members said TraderTraitor had obtained both ChatGPT and DeepSeek accounts.
TOUGH WORKING CONDITIONS
Yet the lifestyle of a hacker or elite technology worker for North Korea is gruelling, particularly when given a mission or sent abroad, say former IT workers and human rights groups.
Living in cramped spaces, often working stretches longer than 10 hours a day, constant surveillance and strict targets are among the downsides, said former IT workers interviewed for a report last year by advocacy group PSCORE.
“There is always pressure to keep earning money,” said the group’s executive director, Nam Bada. “The stress is extreme, and because of the psychological strain people develop health problems they didn’t have before.”
IT workers must meet a monthly target in dollars, or face humiliation and other punishments, he said.
Still, the hackers’ success is likely to embolden the North Korean leader as they get better and grow more ambitious, analysts say.
“We see more and more them leaning towards what we call ‘big game hunting’,” said Zebrick.
“So they’re targeting some of these larger organizations, potentially have larger vaults of funds, that they could potentially get. These are harder targets,” he added.
“However, as we can see with the Binance case, the payout certainly can make it worth their time.”
(Reporting by Heejin Kim, Kyu-seok Shim, Maggie Grether and Brenda Goh; Writing by Brenda Goh; Editing by Clarence Fernandez)
