North Korea-linked hackers have accounted for nearly 89% of reported cryptocurrency hack losses in 2026, according to Chainalysis, as Pyongyang has dismissed international sanctions targeting its revenue and weapons programs.
Summary
- Suspected North Korea-linked attacks account for nearly 89% of reported crypto hack losses this year.
- Average losses per suspected DPRK-linked hack reached $185.65 million, compared with $50.65 million in 2021.
- Investigators linked Binance’s stolen funds to assets taken in September’s North Korea-attributed Bitget attack.
- Pyongyang rejected a multinational sanctions statement addressing overseas workers, cyber activities and military cooperation.
Chainalysis published the figures on Oct. 30, drawing on reported losses through Oct. 29. Across the period beginning in 2021, suspected North Korean operations accounted for $13.24 billion of $22.34 billion in reported cryptocurrency hack losses, or roughly 59%.
The latest annual share compares with 15% in 2021. Calculated from the published percentages, the difference is 74 percentage points, while the average reported loss per suspected North Korea-linked attack is approximately 3.7 times its 2021 level.
North Korea’s crypto thefts grow larger per attack
In its 2025 assessment, Chainalysis estimated that North Korean hackers stole $2.02 billion during that year, 51% more than in 2024, despite carrying out fewer attacks. The firm put their cumulative thefts through 2025 at $6.75 billion.
Its researchers described operations involving IT workers embedded inside cryptocurrency services and impersonation schemes targeting executives. Across centralized services, the report identified attacks on signing processes and private key infrastructure, including efforts to trick legitimate signers into approving malicious transactions.
The February 2025 Bybit breach alone accounted for $1.5 billion. Chainalysis’s historical assessment found that the three largest hacks represented 69% of service losses that year, with individual large breaches accounting for much of the stolen value.
Following the Oct. 29 Binance attack, investigators published estimates exceeding $6 billion for a single incident. As crypto.news reported, Binance estimated that its security breach affected $6.3 billion and pledged to cover customer losses using company resources and its Secure Asset Fund for Users.
Binance tracing connects two exchange thefts
In its investigation, Chainalysis attributed the Binance theft to TraderTraitor, a North Korean cybercrime group. Investigators observed stolen Binance assets mixing with funds from September’s Bitget exploit, which had previously been attributed to North Korean actors.
The firm described the direct connection between the two pools of stolen funds as its strongest evidence supporting the attribution. Its assessment draws on blockchain activity observed after the Binance breach.
Separately, TRM Labs attributed the attack to TraderTraitor with high confidence, citing intelligence gathered both on and off the blockchain. TRM valued the transfers at $6.36 billion using asset prices when the funds were taken and traced outflows across 10 blockchains.
Its investigators identified preparations beginning at least 36 hours before the theft, including small Tornado Cash withdrawals, deployed attack code and wallet rehearsals. TRM said the Ethereum operation used pre-signed authorizations, while wallets on other networks sent ordinary signed transfers.
Investigators observe automated laundering patterns
After the breach, Chainalysis observed thousands of transactions in which stolen funds repeatedly circulated between addresses, sometimes returning to wallets used earlier in the sequence.
Many addresses first received exactly 1 TRX before accepting and forwarding further funds. Investigators said the repeated sequence suggested an automated process for distributing the stolen assets.
During the initial effort to escape stablecoin freezes, the attacker moved $500 million in stablecoins into a wallet used for swaps. Over nearly 20 minutes, $325 million was exchanged for $285 million in ETH, according to the firm. The remaining $175 million was subsequently sent to intermediary wallets.
Binance later announced that it had reserved more than $6.34 billion to replace affected assets and had begun buying back stolen altcoins using Bitcoin, Ethereum and stablecoins.
Pyongyang rejects US-backed sanctions enforcement
In a separate diplomatic statement carried by KCNA on Oct. 31, an unnamed North Korean foreign ministry spokesperson rejected a multinational push to enforce sanctions, Reuters reported.
“Sanctions and pressure may work on the weak but never on us,” the spokesperson said, referring to measures against the country and its nuclear weapons status.
The joint statement, published by the European Union on Oct. 28, said the US, Australia and the EU had imposed sanctions targeting overseas workers, malicious cyber activities and unlawful North Korea-Russia cooperation.
Issued by 11 countries and the EU, it called on UN members to implement existing Security Council resolutions. The signatories cited reporting by the Multilateral Sanctions Monitoring Team, established after Russia blocked renewal of the previous UN expert panel’s mandate in 2024.
