North Korea's hacker army: How Kim Jong Un trains students for billion-dollar cyber heists

North Korea selects talented students at ages 11-12 and trains them as hackers, rewarding them with luxury homes and cash, Reuters reports. Here's how it works.

North Korea is building a specialised army of highly skilled hackers by identifying talented students at a young age and training them for cyber operations, according to a Reuters report published on November 6, 2026.

The report said that the country selects 150-200 students annually for the programme and trains the best in cyberwarfare. The hackers receive, among many other rewards, luxury apartments in Pyongyang, opportunities to travel overseas and cash awards for successful hacking attempts.

The disclosures are made in response to North Korea being prosecuted by the FBI and cryptocurrency exchange Binance for a massive cyberattack that reportedly cost $6.3 billion. The hackers behind the attack, dubbed TraderTraitor, have been linked to blockchain investigation firms.

Pyongyang has rejected the claims, but experts and former North Korean technology workers state that Pyongyang's state-sponsored hacking operation is a significant means for the regime to generate revenue and intelligence.

North Korea identifies young students for hacker training

According to Reuters, North Korea began developing its cyber capabilities in 1998. However, the programme's significance increased during Kim Jong Un's reign. In 2013, he reportedly said that cyberwar was an "all-purpose sword", among nuclear weapons and missiles, as a vital component of the country's military arsenal.

Former North Korean computer science trainer Kim Heung-kwang told Reuters that the selection process begins when students are around 11 or 12 years old. Children are selected and provided with specialised computer science education before the top students attend leading universities at age 17.

Further screening and training in cryptocurrency systems, reverse engineering, advanced mathematics and foreign languages. Only a small number eventually enter the military's cyber units.

Hackers receive luxury homes and cash rewards

Successful hackers are reportedly rewarded by the North Korean government with great rewards. These include apartments in Pyongyang, opportunities for foreign travel, and cash rewards tied to money stolen in cyberattacks.

Kim Heung-kwang told Reuters that hackers' military units could receive up to 30% of the proceeds from a successful heist in US dollars. Those who are successful may also be offered apartments of up to 132 square metres, in which their parents can reside.

Such special privileges may also be offered as membership in the ruling Workers' Party and marriage to influential families, according to Lim Jong-in, professor emeritus at Korea University. In 2024, South Korea's National Intelligence Service estimated that North Korea has about 8,400 cyberwarfare personnel.

Lazarus Group and TraderTraitor linked to cyberattacks

There are several North Korean cyber groups, such as Lazarus Group (APT38) and TraderTraitor. A few months ago, Washington accused Lazarus of stealing hundreds of millions of dollars in cryptocurrency from the Ronin blockchain network in 2022, an incident the FBI has now linked to TraderTraitor.

According to cybersecurity firm Chainalysis, state backing allows North Korean hackers to continue operations even after failed attacks. These entities are increasingly targeting larger entities with significant cryptocurrency assets, said Alec Zebrick, Chainalysis' top manager for Asia-Pacific global services, in an interview with Reuters.

AI tools are becoming part of hacking operations

Artificial intelligence tools are also supposedly being used by North Korean IT workers to aid their efforts. The workers are using tools like ChatGPT, Claude Code and Cursor to write code, make resumes and forge documents and identities, YouTuber Deeveeaar told Reuters.

In 2025, a United Nations sanctions-monitoring team, which includes 11 countries, revealed that TraderTraitor had acquired accounts on ChatGPT and DeepSeek.

However, the work comes with strict conditions. Last year, human rights group PSCORE published a report on the "excessive workload and high demands" placed on North Koreans in the IT sector, noting that they are subject to constant surveillance and challenging financial goals.

Workers are under "extreme pressure" to hit monthly pay targets and suffer humiliation and punishment if they miss, PSCORE executive director Nam Bada said in a statement to Reuters.

Despite such factors, analysts think North Korea's cyberattacks may grow bolder as hackers become more skilled and more organisations are targeted.