Key facts
- Defectors said North Korea picks about 150 to 200 children a year for computer science study from middle school.
- Kim Heung-kwang, a defector who trained hackers, said successful exploits can earn a military unit up to 30% of heist profits.
- Lim Jongin of Korea University said successful cyber personnel are given Pyongyang apartments of up to 132 sq m (1,420 sq ft).
- Binance said hackers used a bogus job interview and software hidden in an advertisement to compromise staff computers.
- South Korea's National Intelligence Service estimated in 2024 that North Korea's cyberwarfare operations employ about 8,400 people.
- The FBI has said TraderTraitor, which blockchain investigators blamed for the Binance hack, is affiliated with Lazarus.
North Korea selects about 150 to 200 of its smartest middle-school students each year, some as young as 11 or 12, to study computer science, and sends top performers at 17 to the country's best universities before a chosen few enter the military's cyber unit, according to Kim Heung-kwang, a defector who trained hackers for the state before fleeing to South Korea in 2004, and two defectors who worked in IT.
The recruits study cryptocurrency protocols and reverse-engineering of foreign hardware devices alongside advanced mathematics and foreign languages, one of the defectors said. Those who do not become hackers are trained to produce software or apps for Western firms through remote jobs, the defectors said.
Kim Heung-kwang said successful exploits can earn a hackers' military unit as much as 30% of a heist's profits in US dollars, and that top performers can receive a flat in Pyongyang where their parents can also stay. Lim Jongin, professor emeritus at the school of cybersecurity at Korea University, said such apartments can reach 132 sq m (1,420 sq ft). One defector said top performers are also eligible for ruling party membership and marriages into elite families.
The FBI and Binance have said North Korea was responsible for the Binance hack, which the report says netted $6.3 billion, and blockchain investigation firms have attributed it to a North Korean group known as TraderTraitor. Pyongyang has denied responsibility, part of a pattern in which it dismisses such blame as fabricated political provocations. Binance said the hackers used a bogus job interview and software hidden in an advertisement to compromise staffers' computers before using an internal AI tool to seize control of systems.
North Korea set up a cyber unit in 1998 and elevated its status after Kim Jong Un came to power and declared in 2013 that cyber warfare was, with nuclear weapons and missiles, an "all purpose sword," the report said. South Korea's National Intelligence Service estimated in 2024 that the North's cyberwarfare operations employ about 8,400 people.
Alec Zebrick, senior manager for Asia-Pacific global services at Chainalysis, said state backing lets the hackers keep going after failures. "Even after failures, they'll continue, because it's very hard for the international community to take action against them," he said. Zebrick said the hackers are increasingly pursuing what he called "big game hunting" against larger organizations.
Former IT workers interviewed for a report last year by advocacy group PSCORE described cramped living spaces, stretches of more than 10 hours a day, constant surveillance and strict targets. PSCORE executive director Nam Bada said workers must meet a monthly dollar target or face humiliation and other punishments.