North Korea’s Elite Hackers Receive Cash Rewards and Luxury Perks for Cyber Heists

North Korea has developed a state-backed network of highly trained hackers, rewarding successful operatives with large cash payments, spacious apartments in Pyongyang and other privileges, according to defectors and cybersecurity analysts.

The programme reportedly identifies talented students at an early age and prepares a select few for cyber operations. Its latest spotlight comes after the $6.3 billion theft from cryptocurrency exchange Binance, which US authorities and blockchain investigators have attributed to a North Korean hacking group.

Pyongyang has denied responsibility for the attack. However, the FBI and blockchain investigation firms have linked it to TraderTraitor, a group associated with North Korea.

North Korea’s Systematic Hacker Recruitment

North Korea established a cyber unit in 1998. However, its importance reportedly increased after Kim Jong Un took power.

In 2013, Kim described cyberwarfare as an essential weapon alongside the country’s nuclear and missile programmes.

According to defectors and former IT workers, the recruitment process begins in middle school. Authorities reportedly select between 150 and 200 talented students each year, some as young as 11 or 12, for specialised computer science education.

At 17, top-performing students move to leading universities for further training and screening. Only a small number eventually join the military’s cyber unit.

Their training covers cryptocurrency systems, reverse engineering, advanced mathematics and foreign languages. Other students pursue software development and remote technology work for overseas companies.

Trump Weighs Resuming Iran Strikes After Meeting National Security Team

Kim Heung-kwang, a North Korean defector who previously trained state hackers, described the programme as a strategic asset for the leadership.

Lim Jong-in, professor emeritus at Korea University’s cybersecurity school, said North Korea directs some of its brightest students towards nuclear and cyber programmes.

Cash Rewards and Privileges for Successful Hackers

Successful cyber operations can bring substantial financial rewards, according to the defectors interviewed.

Kim Heung-kwang said hackers’ military unit could receive as much as 30 per cent of the proceeds from successful operations in US dollars.

Top performers may also receive apartments in Pyongyang. Their parents can reportedly live with them.

Lim said accounts indicated that some successful cyber personnel received apartments measuring up to 132 square metres.

Other reported privileges include travel to allied countries, ruling party membership and opportunities to marry into influential families.

South Korea’s National Intelligence Service estimated in 2024 that North Korea’s cyberwarfare operations involved approximately 8,400 people.

TraderTraitor and the Binance Cryptocurrency Heist

The recent Binance theft has drawn renewed attention to North Korea’s cyber capabilities.

The attack reportedly removed approximately $6.3 billion from Binance wallets across multiple blockchains. The FBI attributed the operation to TraderTraitor, a North Korean state-sponsored hacking unit.

Blockchain investigation firms have also linked the group to the theft. North Korea, however, has rejected the allegations.

Binance said it had covered around $6 billion of the reported losses using company funds to purchase replacement tokens. The exchange also worked with investigators and industry partners to freeze stolen assets.

The attack reportedly involved a fraudulent job interview and malicious software concealed in an advertisement. These methods helped attackers compromise staff computers and gain access to internal systems.

TraderTraitor is also linked to the Lazarus Group, which the United States has accused of carrying out major cryptocurrency thefts.

Artificial Intelligence Becomes Part of Cyber Operations

North Korean IT workers and hacking groups have reportedly adopted artificial intelligence tools for coding and other tasks.

A YouTuber known as Deeveeaar, who has investigated North Korean IT workers, described their operations as highly organised.

He said workers used AI tools to write code, prepare résumés and create documents. He also alleged that some used the technology to forge identities and supporting records.

A United Nations sanctions monitoring team comprising 11 member states reported in 2025 that TraderTraitor had obtained accounts for ChatGPT and DeepSeek.

These accounts and tools reportedly formed part of a wider technology operation. However, the precise role of AI in individual cyberattacks remains difficult to establish.

Long Hours and Strict Working Conditions

Despite the privileges available to successful operatives, North Korean IT workers reportedly face demanding conditions.

Former workers interviewed for a report by advocacy group PSCORE described cramped living spaces, long working hours and constant surveillance.

They also reported strict monthly financial targets. Workers who fail to meet those targets may face humiliation and other punishment, according to PSCORE Executive Director Nam Bada.

Nam said the pressure to generate income creates severe psychological stress and can contribute to health problems.

Workers sent abroad also reportedly face strict supervision and demanding schedules.

Analysts Warn of More Ambitious Cyber Heists

Cybersecurity analysts say state backing allows North Korean hacking groups to continue operating despite repeated failures and international investigations.

Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis, said these groups face fewer immediate consequences than ordinary cybercriminals.

He also noted a shift towards targeting larger organisations with substantial digital assets.

The reported Binance theft could encourage further attacks against major cryptocurrency platforms and financial institutions.

Analysts warn that North Korea’s investment in cyber capabilities may continue to expand as its operatives develop more sophisticated methods.