Three North Korean IT workers sent to China to earn foreign currency were recalled in late October 2026 on suspicion of plotting to defect. They had spent less than a year abroad before their minders ordered them home. The three had grown close after being scolded over poor earnings and shunned by colleagues, and that closeness is what raised suspicion.
A source in Pyongyang told Daily NK on Thursday that the three had been doing hacking and other IT work in China. North Korea relies on IT workers stationed abroad to bring in hard currency for the Kim Jong Un regime despite U.N. sanctions.
All three graduated from universities in Pyongyang and speak both Chinese and English, according to the source. They reportedly paid thousands of dollars in bribes to the agency that controls selection for overseas postings.
What they found after arriving in China did not match their expectations. They were supposed to learn the trade from senior workers who had spent years there. Their lack of hands-on experience, however, made it very hard for them to earn money. Even after a six-month apprenticeship, they still failed to produce any real results. That brought reprimands from their supervisor and cold stares from their co-workers.
North Korean authorities assign overseas IT workers a monthly foreign currency quota and demand that it be met. The quota is set for each worker, but the whole team must also meet it collectively. One person’s shortfall therefore becomes a burden that the other workers have to cover.
“Quotas come down according to head count, so when a few people fall short, the supervisor and the other workers are put in a difficult spot,” the source said. “These three were criticized at every self-criticism session, and the pressure was so heavy they could hardly hold their heads up.”
Self-criticism sessions are mandatory meetings where North Koreans confess their own failings and criticize those of their peers. The state keeps up the weekly practice among workers overseas as a tool of ideological control.
Friendship among IT workers read as a defection plot
Under that pressure, the three workers naturally came to rely on one another. They went out together and spent their free time only as a group. That behavior deepened the suspicions of the National Intelligence Agency agent assigned to monitor the workers’ ideological leanings. The agency, formerly the Ministry of State Security, is North Korea’s secret police and posts agents with work teams abroad.
The agent found it suspicious that the three were struggling to adapt to organizational life. They also kept to themselves instead of mixing with the other workers on the team. The agent reportedly began watching them closely, down to what they discussed in everyday conversation.
Suspicion then spread that the three were meeting in private to plan a defection. The agent and the team’s supervisor concluded that keeping them in China was too risky. They ultimately decided to send all three workers back to North Korea.
“The recall document described them as lukewarm characters who lack skill in carrying out their revolutionary tasks and who, judging by their behavior, could defect at any time,” the source said. “It effectively branded them as people who cannot be trusted ideologically.”
Whether the three ever actually discussed defecting has not been confirmed. By the source’s account, three demoralized workers simply drifted away from their colleagues and grew closer to each other. That bond then snowballed into an accusation that they were plotting to flee.
“They paid a lot of money to get to China and never earned properly once they were there,” the source said. “Now they have been sent home under suspicion of defection less than a year into their posting, and for now nobody knows what will happen to them.”
This article was originally written in Korean and translated with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
Daily NK operates networks of sources inside North Korea who document events in real-time and transmit information through secure channels. Unlike reporting based on state media, satellite imagery, or defector accounts from years past, our journalism comes directly from people currently living under the regime. We verify reports through multiple independent sources and cross-reference details before publication.
Our sources remain anonymous because contact with foreign media is treated as a capital offense in North Korea — discovery means imprisonment or execution. This network-based approach allows Daily NK to report on developments other outlets cannot access: market trends, policy implementation, public sentiment, and daily realities that never appear in official narratives.
Maintaining these secure communication channels and protecting source identities requires specialized protocols and constant vigilance. Daily NK serves as a bridge between North Koreans and the outside world, documenting what’s happening inside one of the world’s most closed societies.
