North Korea Builds Cyber Ranks Through Early Recruitment and Elite Rewards

North Korea recruits gifted schoolchildren for a training system that can lead to military hacking assignments and rewards including apartments in Pyongyang, foreign travel and hard currency, according to defectors and analysts. The program has helped build a cyber force whose activities have expanded from illegal gambling websites to major cryptocurrency thefts.

The FBI and Binance attributed a $6.3 billion hack of the cryptocurrency exchange last month to North Korea, which denied responsibility. Blockchain investigation companies linked the attack to TraderTraitor, a North Korean group. Pyongyang has repeatedly rejected accusations over cyberattacks, describing them as politically motivated fabrications.

Recruitment starts when children are as young as 11 or 12, according to former hacker trainer Kim Heung-kwang and two defectors who worked in information technology. Authorities select about 150 to 200 students annually for computer science education. At 17, leading students advance to the country's top universities, with further screening determining which candidates enter the military's cyber unit. Their studies include cryptocurrency protocols, reverse-engineering foreign hardware, advanced mathematics and foreign languages. Others receive training to develop software or applications through remote work for Western companies.

North Korea established a cyber unit in 1998 and gave it greater prominence after Kim Jong Un took power. In 2013, he placed cyber warfare alongside nuclear weapons and missiles as central elements of the country's strike capabilities. Kim Heung-kwang, who fled to South Korea in 2004, described hackers as among the leader's secret weapons and said recruits have little say in their eventual roles. South Korea's National Intelligence Service estimated in 2024 that North Korean cyberwarfare operations employed roughly 8,400 people.

The rewards can be substantial. Kim Heung-kwang said successful operations could bring the hackers' military unit up to 30% of the proceeds in US dollars. Hackers may also receive a capital-city apartment where their parents can live. Korea University cybersecurity professor emeritus Lim Jongin said accounts of such rewards included apartments measuring up to 132 square meters. One defector said successful personnel could gain ruling party membership and marry into elite families. Travel to allied countries, including China, also provides freer internet access.

Artificial intelligence has become another feature of these operations. YouTuber Deeveeaar, who claims to have accessed cameras monitoring North Korean IT workers, said they use AI to write code, revise resumes and fabricate documents and identities. A sanctions monitoring team comprising 11 United Nations members reported in 2025 that TraderTraitor had acquired ChatGPT and DeepSeek accounts. Binance said its attackers used a fake job interview and software concealed in an advertisement to compromise employees' computers, then exploited an internal AI tool to take control of systems.

The privileges coexist with harsh working conditions. Former IT workers interviewed for a report published last year by advocacy group PSCORE described crowded accommodation, constant monitoring, strict targets and shifts exceeding 10 hours. Executive director Nam Bada said workers must meet monthly dollar earnings targets or face humiliation and other punishments. He said the pressure causes severe stress and health problems.

Analysts say government support allows North Korean hackers to keep refining their methods despite failed attacks. Chainalysis senior manager Alec Zebrick said international difficulties in taking action against them enable repeated operations. He also said the groups increasingly pursue larger organizations with potentially greater funds, accepting harder targets for the possibility of bigger returns.