North Korea rewards top state hackers with Pyongyang apartments up to 132 square meters and 30% cash bonuses after the FBI linked group TraderTraitor to a $6.3 billion cyber heist on crypto exchange Binance on October 29, 2026. While Kim Yo Jong denied involvement, North Korea systematically recruits 150 to 200 middle schoolers annually into a cyberwarfare force estimated at 8,400 personnel.
Binance hack execution and response
- ▪Kim Yo Jong publicly rejected FBI attribution of the Binance heist on November 2, 2026 and November 4, 2026, calling allegations absurd rhetoric
- ▪On October 29, 2026, attackers stole approximately $6.3 billion to $6.36 billion from Binance hot wallets across at least 10 blockchains within roughly 20 minutes
- ▪Binance staffers' computers were compromised using fake job interviews and advertisement-hidden software, enabling control via an internal artificial intelligence tool
- ▪The FBI and blockchain investigation firms attributed the October 29, 2026 Binance cyber heist to the North Korean state-sponsored hacking group TraderTraitor
- ▪Binance committed to covering customer losses from the October 29, 2026 attack and froze a portion of the stolen cryptocurrency assets
TraderTraitor's history of major cryptocurrency heists
- ▪TraderTraitor is affiliated with the Lazarus Group, accused by the U.S. in 2022 of stealing hundreds of millions from the Ronin network
- ▪TraderTraitor was linked to the February 2025 Bybit heist involving approximately $1.5 billion in stolen cryptocurrency
Selection and training of North Korean hackers
- ▪Kim Heung-kwang, a former hacker trainer, said North Korea selects about 150 to 200 middle school students aged 11 or 12 annually to study computer science and engineering
- ▪Kim Heung-kwang, a former hacker trainer, said at age 17, top North Korean computer science students enter elite universities for further screening before joining the military cyber unit
Growth of North Korea's cyber warfare units
- ▪North Korea established a cyber unit in 1998 and elevated cyber warfare alongside nuclear weapons as a core strategic capability in 2013
- ▪South Korea's National Intelligence Service estimated in 2024 that North Korea's cyberwarfare operations employed approximately 8,400 people
Remote IT worker operations
- ▪YouTuber Deeveeaar said North Korean IT workers holding remote jobs at Western companies rely heavily on artificial intelligence tools to write code, alter resumes, and forge identities
- ▪North Korean technology workers who do not become hackers are assigned to develop software applications remotely for Western companies
Harsh IT worker conditions
- ▪PSCORE, an advocacy group, said North Korean IT workers experience intense psychological strain, working stretches exceeding 10 hours daily under strict monthly dollar earning targets
- ▪Nam Bada, PSCORE's executive director, said North Korean IT workers face public humiliation and additional punishments if they fail to meet their assigned monthly dollar earning targets
Story comments
Loading comments…