Apartment, a share of the loot – this is how North Korea trains its hackers

In North Korea, children as young as eleven or twelve are already being scouted as future hackers for Kim Jong-un. The most successful ones may receive a spacious apartment in Pyongyang, and their military unit can receive up to thirty percent of the loot in dollars. Reuters investigated how Pyongyang built this system, after the FBI named a North Korean group as the perpetrator of the October 29 Binance heist. Around $6.3 billion worth of digital assets were stolen from the world's largest cryptocurrency exchange.

Kim Heung Kwang himself trained hackers for the North Korean state before defecting to South Korea in 2004. He and two other defectors told Reuters that every year 150–200 children are selected for IT training, and the best of them, at seventeen, move on to the country's leading universities, from which, after another round of selection, only a few make it into the army's cyber units. Besides mathematics and foreign languages, the training also covers how cryptocurrencies work and how to reverse-engineer foreign computer equipment. According to Kim, those who prove themselves can be allocated an apartment in Pyongyang large enough for their parents to move in with them. Lim Jong-in, a South Korean cybersecurity professor, is aware of reports of apartments measuring 132 square meters, while one of Reuters' sources also mentioned party membership and marriage into elite families among the privileges on offer. Trips abroad are also possible, for instance to China, where internet access is less restricted. Kim described the share of the loot as a reward for the military unit. There is no public information on whether anyone was paid following the Binance operation.

South Korean intelligence estimated in 2024 that around 8,400 people work in North Korea's cyber operations. Pyongyang also makes money from its IT specialists in other ways. Using false identities, they take remote jobs at Western companies, and the state takes a cut of their earnings. According to a source who spoke to Reuters, tools such as ChatGPT, Claude Code and Cursor are also used to write code, rework résumés and produce forged documents. Former North Korean IT workers have told the South Korean human rights organization PSCORE about crowded dormitories, workdays longer than ten hours, and constant surveillance. Monthly dollar quotas had to be met, or else humiliation or other punishment followed. Binance's first statement highlighted a single compromised engineer's laptop, but the later investigation report describes a carefully prepared attack that unfolded over several months. In September, at the end of a fake job interview, an engineer was made to download a test task onto his work computer, which concealed malware. In October, the attackers used this computer to gain access, through one of the company's internal AI-powered tools, to two other employees' computers, and then, using one of their stolen credentials, reached the system that signs transactions. On Ethereum, they abused a feature called EIP-7702, which allows a wallet's operations to be controlled by a program. According to Richard Teng, Binance's co-CEO, the operations approved this way bypassed the exchange's usual controls.

The money started moving on October 29 at around 4:05 p.m. U.S. Eastern Time, and most of the loot was taken within roughly twenty minutes. Including later transfers, Elliptic identified a total of $6.43 billion stolen across eleven blockchains. Of this, $3.8 billion was moved on the Ethereum network, mostly in various tokens, while 18,270 bitcoin also disappeared — worth nearly $1.5 billion at the exchange rate at the time. That single item alone was as large as the previous record, the February 2025 robbery of Bybit, for which the FBI likewise held TraderTraitor responsible.

Tether and Circle began freezing the stolen tokens within the first hour. By November 1, Elliptic was able to confirm $2.85 billion in frozen or seized assets, while the attackers are attempting to launder the remaining, movable loot through thousands of wallets. Binance pledged to cover customers' losses from its own funds, reporting 90 percent reimbursement on October 31 and already 98 percent by November 4, with payouts gradually resuming from November 1. Meanwhile, bitcoin fell to a six-week low on the market, and Coinbase shares lost 4.8 percent in after-hours trading in the United States.

On October 31, the FBI published the wallet addresses linked to the money laundering and asked crypto service providers to block transactions involving them. Kim Yo-jong, Kim Jong-un's sister, naturally called the accusation a political provocation, but according to Elliptic, the trail of the money supports the FBI's findings. TRM Labs estimates that last year, worldwide, close to 150 attacks resulted in a total of $2.87 billion worth of stolen crypto — and from Binance alone, more than twice that amount was taken in a single night. According to Ari Redbord, an expert at TRM, money from such thefts also feeds North Korea's weapons programs: in this story, the Pyongyang apartment is the state reward, but the hackers are sent out for billions because the regime needs the foreign currency that is becoming increasingly hard to obtain under sanctions.

Ugar