North Korea’s top cyber operatives are reportedly rewarded with spacious apartments in Pyongyang and large hard currency bonuses, according to Reuters. The perks come as the regime denies involvement in the theft of $6.3 billion from Binance.
What happened at Binance
On October 29, 2026, Binance lost approximately $6.3 to $6.36 billion from its hot wallets—internet-connected accounts used for everyday withdrawals. The funds were moved in roughly 20 minutes across at least 10 blockchains, a technique that complicates tracing and freezing.
The FBI and blockchain investigators have attributed the attack to TraderTraitor, a North Korean state-sponsored group purportedly linked to the Lazarus Group. The attack reportedly relied on social engineering, including fake job interviews and compromise of internal systems, rather than brute force.
Binance has committed to covering customer losses and has frozen a portion of the stolen assets, though the full amount recovered has not been specified.
The perks of being a state hacker
According to research findings, North Korea runs a longstanding incentive program to recruit and retain skilled hackers. Rewards reportedly include apartments in Pyongyang of up to 132 square meters, cash bonuses reaching up to 30% of heist proceeds, and elite social status. Recruitment efforts reportedly target middle-school students for specialized computer-engineering training.
Pyongyang says no
Kim Yo Jong, sister of leader Kim Jong Un, publicly rejected the FBI’s attribution on November 2 and again on November 4, 2026. North Korean officials have called the allegations “absurd rhetoric” and framed them as part of a broader political conflict with the United States. Her messages were broadcast on television in South Korea, including at a railway station in Seoul.
A pattern years in the making
TraderTraitor is also linked to the February 2025 Bybit heist, which involved approximately $1.5 billion—at the time among the largest crypto thefts on record. The Binance figure is more than four times larger. The research describes the October 2026 attack as a culmination of cyber tactics refined over years, with methods evolving to target the human layer of organizations through fake recruitment schemes and insider compromises.
What this means for exchanges and users
The scale of the theft raises questions about hot wallet exposure, as exchanges keep funds online to serve withdrawals quickly. Binance’s pledge to cover customer losses limits direct damage to users, but trust is harder to reimburse than tokens. If hackers can reportedly earn up to 30% of proceeds plus housing and status, the regime has built a system that rewards bigger and bolder attacks.
