North Korea reportedly rewards top hackers with Pyongyang apartments after alleged Binance heist

North Korea’s best hackers reportedly get a corner office, of sorts. Reuters reports that the regime rewards its top cyber operatives with spacious apartments in Pyongyang and large hard currency awards.

The timing is awkward for a government that insists it had nothing to do with the theft of $6.3 billion from Binance. Officials in Pyongyang deny the FBI’s attribution. The perks package, meanwhile, suggests a well-funded program that knows exactly what it is paying for.

What happened at Binance

On October 29, 2026, Binance lost approximately $6.3 to $6.36 billion from its hot wallets. Hot wallets are the internet-connected accounts exchanges use to process everyday withdrawals. They work like a cash register rather than a bank vault: convenient, but more exposed.

The funds moved fast. The transfers reportedly unfolded in roughly 20 minutes and spanned at least 10 blockchains. Spreading stolen assets across that many networks makes them harder to trace and freeze.

The FBI and blockchain investigators have pointed to TraderTraitor, a North Korean state-sponsored hacking group. The group is purportedly linked to the Lazarus Group, the regime’s most notorious cyber unit.

The attack reportedly relied on social engineering rather than brute force. That included fake job interviews and the compromise of internal systems.

Binance has committed to covering customer losses. The exchange has also managed to freeze a portion of the stolen assets, though the full amount recovered has not been specified.

The perks of being a state hacker

According to the research findings, North Korea runs a longstanding incentive program designed to recruit and retain skilled hackers. The rewards reportedly include apartments in Pyongyang of up to 132 square meters.

Cash is part of the deal too. Bonuses can reportedly reach up to 30% of heist proceeds. Successful operatives also gain elite social status, which carries real weight in North Korean society.

The pipeline starts early. North Korea’s recruitment efforts reportedly target middle-school students for specialized computer-engineering training.

Pyongyang says no

Kim Yo Jong, the sister of leader Kim Jong Un, publicly rejected the FBI’s attribution on November 2 and again on November 4, 2026. North Korean officials have called the allegations “absurd rhetoric” and framed them as part of a broader political conflict with the United States.

Her messages were broadcast on television in South Korea, including at a railway station in Seoul.

A pattern years in the making

TraderTraitor has history. The group is linked to the February 2025 Bybit heist, which involved approximately $1.5 billion. At the time, that incident was itself among the largest crypto thefts on record.

The Binance figure is more than four times larger. The research describes the October 2026 attack as a culmination of cyber tactics refined over years of operations.

The methods have also evolved. Fake recruitment schemes and insider compromises target the human layer of an organization. No amount of smart contract auditing fixes an employee who downloads the wrong file during a fake interview.

What this means for exchanges and users

For the crypto industry, the scale of the theft raises uncomfortable questions about hot wallet exposure. Exchanges keep funds online to serve withdrawals quickly.

Binance’s pledge to cover customer losses helps limit the direct damage to users, but trust is harder to reimburse than tokens.

If hackers can reportedly earn up to 30% of proceeds plus housing and status, the regime has built a system that rewards bigger and bolder attacks.