North Korea Stole 89% of All Crypto Hacked in 2026: Inside the $12.8 Billion Theft Machine

North Korea-linked hackers stole 89% of all the crypto lost to hacks in 2026. That is not a typo, and it is not a rounding trick: according to blockchain analytics firm Chainalysis, nearly nine dollars in every ten stolen from crypto hacks this year traces back to groups suspected of working for Pyongyang. The single biggest reason is the $6.3 billion Binance theft of October 29, 2026 — the largest crypto heist in history, pulled off in about 20 minutes. But the Binance job is only the latest chapter in a theft machine that has now taken an estimated $12.8 billion since 2017. This is how it works, how the money gets laundered, why $2.7 billion could be frozen while $2.4 billion could not, and what it means for anyone holding crypto on an exchange today.

Two numbers in this story look contradictory at first glance, so let us clear that up immediately: Chainalysis puts the suspected North Korea share of reported 2026 hack losses at 89%, while TRM Labs puts North Korea's share of total hacked value in 2026 at 85%. They measure slightly different universes — reported losses versus total value — but both point the same way. Whichever dataset you prefer, one state actor now dominates crypto crime the way no single group ever has before. If you want the practical side first — how to keep your own coins out of the next headline — read our guide to protecting your crypto from hacks and scams alongside this story.

The 20 Minutes That Broke Every Record

On October 29, 2026, at about 20:05 UTC, roughly $6.36 billion began draining out of Binance wallets across ten blockchains, according to TRM Labs. Most of it moved in about 20 minutes. Around $3.79 billion left on Ethereum, about 18,270 BTC (roughly $1.47 billion) on Bitcoin, and about $628 million on Tron, with smaller amounts on seven other chains including Solana, XRP Ledger and others. For scale, that is roughly four times the $1.5 billion Bybit theft of February 2025, which held the previous record. Our full account of that night is in Binance Hack Explained: $6.3 Billion Stolen, Bitcoin Crashes to $76,400.

Binance's early investigation points to a compromised laptop belonging to a DevOps engineer, and the exchange says it has found no evidence that wallet private keys leaked. Binance has also said user funds are safe and that all losses will be covered from its SAFU emergency fund and company money, with withdrawals paused for a security revamp and expected to resume within about two days of the incident. What Binance has not done is name an attacker. The attribution to North Korea comes from TRM Labs and Chainalysis, not from the exchange, and no government has formally attributed the Binance theft at the time of writing. North Korea has consistently denied involvement in crypto thefts. That distinction matters: this article reports an attribution by two leading analytics firms, with their stated evidence, not a proven court finding.

89%: How One Country Came to Dominate Crypto Crime

The Chainalysis figures tell a story of concentration that has accelerated every year. In 2021, suspected North Korea-linked hacks accounted for just 15% of reported crypto hack losses. By 2026 that share hit 89% — nearly a sixfold rise. The average loss per suspected North Korea-linked hack surged in parallel, from $50.65 million in 2021 to $185.65 million in 2026. The hackers are not striking more often so much as striking much, much bigger.

TRM Labs' longer view fills in the total: about $12.8 billion stolen across 100 incidents since 2017, of which $7.4 billion came in 2026 alone. Five incidents — Binance, Bybit, Ronin, Bitget and DMM Bitcoin — account for $9.1 billion of that $12.8 billion total. In other words, a handful of infrastructure compromises, not a spray of small thefts, built the fortune. From 2021 through October 29, 2026, Chainalysis counts $13.24 billion in suspected North Korea-linked losses out of $22.34 billion in total reported hack losses — 59% across nearly six years. The 2026 spike, driven by Binance, pushed the single-year share to 89%.

And 2026 was already a record year for crypto hacking before Binance. TRM Labs puts total 2026 hack losses at $8.7 billion year to date, the highest on record, with the Binance theft accounting for most of the increase. Remove North Korea from the data and the picture changes completely: infrastructure attacks make up just 21% of the value stolen by all other hackers combined.

The Theft Machine: Infrastructure Attacks, Not Code Exploits

Here is the detail most coverage skips, and it is the key to understanding why these thefts are so large. Only 13 of North Korea's 100 attributed incidents are code exploits — smart-contract bugs and the like — and together they add up to about 1% of what North Korea has stolen. The real weapon is infrastructure attacks: compromises of the keys, servers and signing systems behind the money. Before Binance, about 76% of North Korea's stolen value came from infrastructure attacks; including Binance, the share is 88%.

The Binance attack, as reconstructed by TRM Labs, shows the playbook in forensic detail. The attacker funded an operator wallet with three small withdrawals from Tornado Cash, a crypto mixing service, on the morning of October 28 — a full day before the theft. The attacker then tested the attack code on three wallets before installing it on a Binance hot wallet, the internet-connected wallet an exchange uses to process withdrawals. The route into Ethereum used EIP-7702, a feature added to the network in May 2025 that lets a wallet hand control of its behaviour to a smart contract through a signed authorisation — and the attacker held 50 of them pre-signed by Binance's Ethereum hot wallet. TRM says the Tornado Cash funding, the staging well in advance and the burst of pre-obtained signatures match earlier North Korea-linked heists, including Bybit and the KelpDAO exploit. Chainalysis adds a second thread of evidence: funds stolen from Binance were mixed on-chain with funds stolen from Bitget the previous month, which it cites as the basis for its attribution to TraderTraitor, the North Korean state-sponsored unit the FBI previously linked to the Bybit theft.

This is why the usual "audit the smart contract" advice misses the point. The targets are people and processes: engineers with privileged access, laptops, signing workflows, and the gap between a hot wallet's convenience and its exposure. TraderTraitor has repeatedly used social engineering — fake job offers and recruiter approaches aimed at crypto workers — to get inside organisations, a tactic documented across its campaigns. The code is often fine. The humans and the keys are the vulnerability.

The $2.7 Billion Freeze — and the $2.4 Billion Nobody Can Touch

After the Binance theft, stablecoin issuers and the Arbitrum Security Council moved fast. Tether, Circle, Ripple and World Liberty Financial froze nearly $2.7 billion in stablecoins, and Arbitrum's Security Council seized about $30 million more, according to TRM Labs. That is the largest coordinated freeze in crypto history, and it is only possible because stablecoins like USDT and USDC have issuers who can blacklist addresses.

But the attacker moved faster in one crucial respect: swapping stablecoins for ether, at a steep discount, before the freezes landed. The result is that roughly $2.4 billion remains in ETH and bitcoin — assets with no issuer to freeze them. No company can blacklist a bitcoin address. That $2.4 billion is the hard core of the haul, and it is why the laundering phase matters as much as the theft itself. Expect it to move slowly, in tranches, through mixers, chain-hopping and over-the-counter brokers, exactly the pattern seen after Bybit, where laundering took weeks and still left trails analysts could follow.

The freeze also exposes a tension the crypto world rarely confronts honestly. The same issuer freeze power that just saved $2.7 billion of Binance's stolen funds is the centralisation critics warn about — and in this case, most users were glad it existed. For a plain-English explanation of the stablecoins at the centre of this fight, see our guide to Tether (USDT) and our guide to USDC.

What Most People Get Wrong About the North Korea Crypto Story

Three myths keep circulating, and each one leads to bad decisions:

• Myth: the hackers are genius coders breaking blockchains. Reality: blockchains were not broken. In 99% of the value stolen, the attack compromised the organisation around the blockchain — keys, laptops, signing systems — not the chain itself. Bitcoin's network, for example, kept producing blocks throughout. If you are new to how that network actually works, start with What Is Bitcoin? The Complete Beginner's Guide.
• Myth: because Binance will cover the loss, exchange hacks do not matter to ordinary users. Reality: Binance's SAFU pledge covers this incident, but withdrawal pauses, frozen assets and market crashes are costs users pay immediately — Bitcoin fell to about $76,400 and the Crypto Fear & Greed Index dropped 21 points to 30 (Fear) in a single day. Coverage is not the same as immunity, as we examined in Is Binance Safe After the $6.3B Hack?.
• Myth: sanctions and attribution will stop the next theft. Reality: attribution has improved dramatically — analysts named TraderTraitor within about a day of the Binance theft — but the group keeps operating because the money funds a regime largely cut off from the global financial system, and laundering routes keep evolving. Deterrence through naming has not worked; defence through better key management has to.

The Bigger Picture: A Market Already on Edge

The theft did not hit a calm market. Bitcoin was trading around $77,367 on October 31, up slightly on the day but about 39% below its all-time high of $126,080, with total crypto market capitalisation near $2.7 trillion. Bitcoin was on track to close October about 7.7% lower — its worst October since 2014, according to CoinGlass data cited by Cointelegraph — as a tech-stock selloff and a drop in gold compounded the hack fallout. About $1.57 billion in crypto futures positions were liquidated in 24 hours around the selloff, with Bitcoin accounting for roughly $522 million and Ether about $361 million. Fear was already in the air; the hack turned it into a rout, then a stabilisation. For the latest market picture, see CoinStats' October 31 market roundup and Cointelegraph's report on Bitcoin's worst October in 12 years.

None of this means the market is finished — October 31 also saw Bitcoin steady near $77,400 and Ethereum lead the majors higher — but it does mean the next few weeks are a stress test for the industry's security story. Binance has promised a full post-mortem and an updated proof of reserves. Traders will read both closely: the post-mortem for how a DevOps laptop could authorise $6.3 billion in outflows, and the proof of reserves for whether customer assets remain fully backed after the SAFU payout.

North Korea's Crypto Hauls: The Numbers That Matter

Figure	Number	Source
Share of reported 2026 hack losses, suspected North Korea-linked	89%	Chainalysis
Share of total 2026 hacked value, North Korea	85%	TRM Labs
Total stolen since 2017 (100 incidents)	$12.8 billion	TRM Labs
Stolen in 2026 alone	$7.4 billion	TRM Labs
Binance theft, October 29, 2026	$6.36 billion in ~20 minutes	TRM Labs
Five biggest heists (Binance, Bybit, Ronin, Bitget, DMM)	$9.1 billion	TRM Labs
Stablecoins frozen after Binance theft	~$2.7 billion	TRM Labs
Still held in ETH and BTC, unfreezable	~$2.4 billion	TRM Labs
Average loss per suspected NK hack, 2026 vs 2021	$185.65M vs $50.65M	Chainalysis
Total crypto hack losses, 2026 year to date	$8.7 billion (record)	TRM Labs

Read the table as a warning about concentration: crypto crime is no longer a scattered nuisance. It is dominated by one well-resourced actor using one method — infrastructure compromise — against the industry's biggest targets. The defence that matters most is therefore boring and organisational: hardware-backed keys, multi-party signing, strict separation between hot and cold wallets, and treating any recruiter message to an engineer with privileged access as a potential attack.

What Happens Next: 5 Things to Watch

• Binance withdrawals resume: Binance said withdrawals were on track to resume within about 45 hours of the incident, pointing to early Sunday, November 1. Any delay will be read as a signal the security revamp found more problems.
• The post-mortem and proof of reserves: both promised by Binance. The post-mortem must explain the DevOps laptop compromise and the 50 pre-signed EIP-7702 authorisations; the proof of reserves must show customer funds intact after the SAFU payout.
• Movement of the $2.4 billion: analysts will track the ETH and BTC tranches through mixers and brokers. Large movements historically precede further market volatility, not because the coins are sold instantly but because the market prices in the overhang.
• Regulatory reaction: a state-sponsored theft of this size, attributed by two major analytics firms, invites sanctions designations, exchange security requirements and renewed debate over issuer freeze powers and mixer sanctions.
• The next target: TraderTraitor's history — Bybit, Bitget, KelpDAO, now Binance — suggests the group returns to large, centralised targets with hot-wallet exposure. Exchanges that cannot show hardware-backed, multi-signature hot-wallet controls will face the hardest questions from users.

How to Protect Your Own Crypto: A Checklist

• Move long-term holdings off exchanges: use a hardware wallet for coins you do not trade weekly. Our comparison of the best crypto wallets for beginners covers hot versus cold options.
• Turn on every security control offered: hardware security keys over SMS codes, withdrawal address whitelisting, and anti-phishing codes on emails.
• Verify, then trust, exchange claims: after any major incident, wait for the proof of reserves and post-mortem before increasing balances — and read them, not just the headline.
• Beware the second wave: major hacks are followed by phishing waves impersonating the exchange's support team. Binance will never ask for your password or seed phrase to "secure" your account.
• Workers in crypto, take note: unsolicited recruiter approaches with coding tests or file downloads are TraderTraitor's classic entry point. Verify the company through independent channels before opening anything.
• 

Frequently Asked Questions

Did North Korea really steal 89% of hacked crypto in 2026?

According to Chainalysis, suspected North Korea-linked hacks accounted for 89% of reported crypto hack losses in 2026, up from 15% in 2021. TRM Labs independently puts North Korea's share of total hacked value in 2026 at 85%. The figures differ because the datasets differ, but both show overwhelming dominance driven by the $6.3 billion Binance theft.

How much has North Korea stolen in crypto overall?

TRM Labs estimates about $12.8 billion across 100 incidents since 2017, with $7.4 billion of that in 2026 alone. Five incidents — Binance, Bybit, Ronin, Bitget and DMM Bitcoin — account for $9.1 billion of the total.

Who is TraderTraitor?

TraderTraitor is a North Korean state-sponsored hacking unit that TRM Labs and Chainalysis attribute the Binance theft to, with TRM citing "high confidence" based on on- and off-chain intelligence. The FBI previously linked the same unit to the $1.5 billion Bybit theft of February 2025. Binance itself has not named an attacker, and no government has formally attributed the Binance theft.

Was Binance's hack a smart-contract bug?

No. Binance's early finding points to a compromised DevOps engineer's laptop, and TRM's reconstruction describes pre-signed EIP-7702 authorisations and a staged attack on hot wallets. Only about 1% of North Korea's stolen value comes from code exploits; about 88% comes from infrastructure attacks on keys, servers and signing systems.

Will Binance users get their money back?

Binance says user funds are safe and losses will be covered from its SAFU emergency fund and company money, with withdrawals expected to resume within about two days of the incident. Users should still watch for the promised post-mortem and updated proof of reserves.

Can the stolen $2.4 billion in ETH and BTC be recovered?

Probably not in full. About $2.7 billion in stablecoins was frozen because issuers can blacklist addresses, but ETH and BTC have no issuer to freeze them. Recovery depends on tracing the funds through mixers and brokers, law-enforcement seizures, and sanctions — a slow process that recovered only part of the Bybit haul.

Conclusion: The Industry's Security Story Just Changed

The 89% figure should end any lingering idea that crypto hacks are random misfortune spread evenly across the industry. They are concentrated, state-backed, and aimed at the infrastructure behind the biggest wallets. The Binance theft — $6.36 billion in 20 minutes, staged a day in advance, routed through a feature added to Ethereum in 2025 — shows an adversary that studies its targets for months and strikes at the human and procedural layer, not the cryptographic one.

For ordinary holders, the lesson is practical, not geopolitical: keep trading balances small, long-term holdings in cold storage, and security controls at maximum — and judge exchanges by their post-mortems and proof of reserves, not their marketing. For the industry, the lesson is harder: until hot-wallet signing, key management and insider-access controls match the value they guard, the next record theft is a matter of when, not if. The $2.4 billion still moving through the shadows is a reminder that the Binance story is not over — it has just entered its laundering phase. Sources for the key figures in this article include TRM Labs' analysis, TokenPost's report on the Chainalysis figures, and The Wall Street Journal's reconstruction of the Binance heist.