SEOUL — North Korea's most accomplished hackers — the unit blamed for last month's $6.3 billion theft from cryptocurrency exchange Binance — are rewarded with perks including spacious apartments in Pyongyang and large hard-currency bonuses, even as they endure grueling working hours.

Leader Kim Jong Un has built an army of world-class hackers on such incentives through a program more than a decade old that each year selects around 200 of the country's smartest middle-school students to study computer engineering, according to defectors and analysts.

Only a fraction of those recruits eventually become hackers, but the investment has paid off dramatically: the group has evolved from running illegal gambling websites in its early days to executing the world's biggest cyber heist, which took place last month.

"They are actually one of Kim Jong Un's secret weapons," said Kim Heung-kwang, a North Korean defector who trained hackers on behalf of the state before fleeing to South Korea in 2004. "There is no other country grooming hackers like this, systematically searching for the smartest children, solely to turn them into operatives. Whether they want to be a hacker or not does not matter."

The FBI and Binance have said North Korea was responsible for the Binance hack, which Pyongyang denies. Blockchain investigation firms have attributed the attack to a North Korean group known as "TraderTraitor." The denial fits a long-standing pattern in which the North dismisses such accusations over the years as fabricated political provocations.

Systematic Selection

North Korea established a cyber unit in 1998, but elevated its status after Kim came to power and declared in 2013 that cyber warfare, alongside nuclear weapons and missiles, was an "all purpose sword" crucial to the country's strike capability.

Selection begins in middle school, with children as young as 11 or 12 identified by the authorities; roughly 150 to 200 are chosen each year to study computer science, said Kim Heung-kwang and two defectors who worked in IT.

At 17, the top performers are sent to North Korea's best universities and undergo further screening before a chosen few finally enter the military's cyber unit as hackers, the defectors said. Trainees study cryptocurrency protocols and the reverse-engineering of foreign hardware devices, in addition to more conventional subjects such as advanced mathematics and foreign languages, one of them said.

Those who do not become hackers are trained instead to produce software or apps for Western firms through remote jobs. The divide creates a two-track revenue model for the program — proceeds siphoned in heists on one side, wages from covert remote work inside Western firms on the other.

"While South Korea's best students may pursue medicine or other prestigious careers, North Korea channels top talent into nuclear and cyber programs and essentially guarantees their future," said Lim Jongin, professor emeritus at the school of cybersecurity at Korea University.

Perks of the Trade

The privileges on offer for hackers include travel abroad to allied countries such as China, where they can access the internet more freely. Successful exploits can earn the hackers' military unit as much as 30% of a heist's profits in US dollars, and operatives can even receive a flat in the capital where their parents may stay as well, Kim Heung-kwang said.

"There are accounts that successful cyber personnel are given apartments in Pyongyang," Lim said, adding that the flats could measure as much as 132 sq m (1,420 sq ft).

Top performers are also eligible for membership of the ruling party and high-status marriages into elite families, one of the defectors said.

It remains a small group: the North's cyberwarfare operations employ about 8,400 people, South Korea's National Intelligence Service estimated in 2024.

North Korean state media do not publicly celebrate hackers' achievements, but they regularly highlight students who show talent for programming. In 2015, the country opened the Mirae Scientists Street in the capital, a construction project with which Kim Jong Un had been closely involved, state media said. Hackers' formal designation in the North is "scientist" or "researcher," one defector said.

The State Advantage

Other hacking groups associated with North Korea include the Lazarus Group, also known as APT38, which the United States accused in 2022 of stealing hundreds of millions of dollars worth of cryptocurrency from the Ronin blockchain network. The FBI has said TraderTraitor is affiliated with Lazarus.

Analysts said state backing makes the North's hackers more dangerous and harder to repel, because they face no consequences for hack after hack, enabling them to perfect their strategies. For cryptocurrency platforms, that endurance is the crux of the threat: unlike typical criminal crews, the program can absorb failure, refine its tradecraft across operations and return to the same target class again and again.

"In the world of cyber crime, often, if you make a mistake … that is all law enforcement needs to get you," said Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis. But North Korea's hackers "are doing this for the regime, so they're going to continue, even after successes," he added. "Even after failures, they'll continue, because it's very hard for the international community to take action against them."

Groups that have engaged with North Korean IT workers — who earn funds for the Kim regime by landing remote technology jobs at Western companies — describe them as highly organized, polite in their interactions and avid users of AI.

"There clearly was a structure you would see in military. Strict times, cleaning boots, very orderly," said YouTuber Deeveeaar, who has claimed to have hacked into cameras watching North Korean IT workers at their jobs. "To say they 'use a lot of AI' is an understatement. AI is the very backbone of their operation," he said, citing paid ChatGPT accounts, Claude Code and Cursor among many AI tools. "They write code with it, alter their resumes and help make new ones. And even forge documents and identities."

Binance said the hackers used a bogus job interview and software hidden in an advertisement to compromise staffers' computers before using an internal AI tool to seize control of systems. In 2025, a sanctions monitoring team drawn from 11 United Nations members said TraderTraitor had obtained both ChatGPT and DeepSeek accounts.

Tough Working Conditions

Yet the lifestyle of a hacker or elite technology worker for North Korea is grueling, particularly when given a mission or sent abroad, say former IT workers and human rights groups.

Living in cramped spaces, often working stretches longer than 10 hours a day, constant surveillance and strict targets are among the downsides, according to former IT workers interviewed for a report published last year by advocacy group PSCORE.

"There is always pressure to keep earning money," said the group's executive director, Nam Bada. "The stress is extreme, and because of the psychological strain people develop health problems they didn't have before."

IT workers must meet a monthly target in dollars or face humiliation and other punishments, he said.

Still, the hackers' success is likely to embolden the North Korean leader as they grow more skilled and more ambitious, analysts say.

"We see more and more them leaning towards what we call 'big game hunting'," Zebrick said. "So they're targeting some of these larger organizations, potentially have larger vaults of funds, that they could potentially get. These are harder targets. However, as we can see with the Binance case, the payout certainly can make it worth their time."

— Reuters