North Korea-Linked Hacks Account for 89% of 2026 Crypto Theft, Chainalysis Says
Chainalysis data published October 30 attributes nearly 89% of reported crypto hack losses in 2026 to suspected North Korean operations, up from 15% in 2021. TRM Labs estimates the share at about 85%, and both firms tie the largest recent theft, the $6.3 billion Binance breach, to the TraderTraitor group.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Scale of the Share Shift
Suspected North Korea-linked hacks accounted for nearly 89% of reported crypto hack losses in 2026 year to date, according to blockchain analytics firm Chainalysis, which published the figures on October 30 using data through October 29. In 2021 the share was 15%. Across the full period from 2021 through October 29, 2026, Chainalysis estimates total reported losses at $22.34 billion, of which $13.24 billion, or about 59%, is attributed to suspected DPRK operations.
Rival analytics firm TRM Labs puts North Korea's share of 2026 hack value at around 85%, a figure that differs from Chainalysis's because the two firms use different methods and time windows. TRM estimates the regime's cumulative theft since 2017 at $12.8 billion to $13.5 billion, with $7.4 billion stolen in 2026 alone. Both sets of numbers point in the same direction even though they do not reconcile exactly.
Fewer Attacks, Larger Payoffs
Chainalysis reports that the average loss per suspected DPRK-linked incident rose from $50.65 million in 2021 to $185.65 million so far in 2026, a multiple of about 3.7. The firm reads this as a shift toward fewer, larger strikes rather than a rise in hacking volume, which it interprets as deliberate targeting of high-value platforms.
In its 2025 assessment, Chainalysis had estimated North Korean thefts that year at $2.02 billion, 51% more than in 2024 despite fewer attacks, and a cumulative total of $6.75 billion through 2025. The February 2025 Bybit breach alone accounted for $1.5 billion of that activity.
The Binance and Bitget Incidents
The largest single event in the dataset is the October 29 Binance breach. Binance has estimated the affected amount at $6.3 billion and says it has reserved more than $6.34 billion to replace affected assets, with buybacks of stolen altcoins under way using Bitcoin, Ethereum and stablecoins. TRM Labs values the transfers at $6.36 billion and traced outflows across 10 blockchains. Chainalysis attributes the theft to TraderTraitor, citing the mixing of stolen Binance assets with funds from the September 2026 Bitget exploit, which was previously attributed to North Korean actors. TRM also attributes the attack to TraderTraitor with high confidence, based on on-chain and off-chain intelligence.
TRM says preparations began at least 36 hours before the theft, including small Tornado Cash withdrawals, deployed attack code and wallet rehearsals. Chainalysis describes thousands of later transactions in which funds circulated repeatedly between addresses, a pattern it says suggests automated distribution. Attackers also moved $500 million in stablecoins to escape freezes, with $325 million exchanged for $285 million in ETH over roughly 20 minutes.
Method and Diplomatic Context
The techniques described rely less on code-breaking than on social engineering, including impersonation of executives and efforts to trick legitimate signers into approving malicious transactions, along with multi-chain laundering. Chainalysis also describes IT workers embedded inside crypto services.
The findings arrive as Pyongyang rejects international sanctions aimed at its revenue and weapons programs. In a KCNA statement on October 31, an unnamed North Korean foreign ministry spokesperson rejected a multinational push to enforce those sanctions.
Why It Matters
For Traders
Concentrated exchange breaches can trigger sharp short-term volatility in affected venues and tokens, so monitor Binance-related asset flows and reserve disclosures closely.
For Investors
A structural shift toward state-linked, high-value attacks raises the risk premium on centralized custody and may push institutions toward stronger security standards.
For Builders
Signing infrastructure, pre-signed authorizations and social-engineering defenses now deserve as much design attention as smart contract audits.
This article is for information only and is not financial advice. Read the full disclaimer.
