North Korea Tied to 89% of 2026 Crypto Hack Losses: Report

Chainalysis: DPRK-linked groups dominate 2026 crypto hack losses

Chainalysis reported on Oct. 30 that suspected North Korea-linked cyber operators are responsible for nearly 89% of disclosed cryptocurrency hack losses tracked in 2026. The firm analyzed incidents reported through Oct. 29 and found that Pyongyang-affiliated attackers have escalated both the scale and sophistication of crypto thefts, even as international sanctions aim to curb revenue streams that allegedly fund weapons and other state priorities.

High-level figures and historical context

According to the analysis, suspected North Korea-linked operations accounted for roughly $13.24 billion of the $22.34 billion in reported crypto hack losses dating from 2021 through the latest reporting period — nearly 59% of the cumulative total. For 2026 specifically, the share of reported hack losses traced to DPRK-linked actors jumps to about 89%, a sharp rise from an estimated 15% in 2021.

Chainalysis also highlights a steep increase in average losses per suspected DPRK-linked incident. The mean reported loss per attributed attack reached about $185.65 million in the most recent reporting window, compared with $50.65 million in 2021 — roughly 3.7 times larger on a per-incident basis.

Major breaches and linked incidents

Chainalysis and other blockchain intelligence firms linked several headline-making breaches to North Korea-associated groups. Notably, investigators connected the October Binance security incident to TraderTraitor, an actor previously tied to DPRK cyber operations. Blockchain tracing showed stolen Binance funds mixing with assets from a September exploit of Bitget, which had also been attributed to North Korea-linked actors.

Those cross-chain movements and mixing patterns were presented by Chainalysis as some of the strongest on-chain evidence tying the incidents together. TRM Labs independently attributed the Binance incident to TraderTraitor with high confidence, valuing transfers at about $6.36 billion based on asset prices at the time of theft and tracing flows across ten blockchains.

Historical thefts and concentrated losses

Chainalysis' 2025 assessment previously estimated North Korean-linked thefts at $2.02 billion for that year, up 51% from 2024 despite fewer attacks. The firm recorded large single incidents that dominate yearly totals: for example, Bybit's February 2025 breach was estimated at $1.5 billion, and the three largest incidents in that year comprised a sizable share of overall service losses.

Cumulatively, Chainalysis placed DPRK-linked thefts at $6.75 billion through 2025, a base that has since been eclipsed by major 2026 breaches.

Techniques: infiltration, key compromises, and automated laundering

Researchers describe a diverse toolkit: social-engineering campaigns that impersonate exchange staff or executives, insertion of IT personnel into critical operations, and direct attacks on signing processes and private key infrastructure. In some instances, malicious actors reportedly tricked legitimate signers into approving fraudulent transactions, a tactic that undermines centralized custody procedures.

After the most recent breaches, investigators observed automated laundering patterns. Stolen funds were routed through thousands of transactions with funds bouncing between addresses and occasionally returning to wallets used earlier in the laundering chain. A commonly seen pattern was addresses that first accepted exactly 1 TRX before receiving and forwarding larger amounts, consistent with scripted or bot-driven distribution.

During an early attempt to evade stablecoin freezes, attackers moved roughly $500 million in stablecoins into a swap wallet. Chainalysis reported that over about 20 minutes, $325 million of those stablecoins were swapped for $285 million in ETH, with the remaining $175 million directed to intermediary wallets — a rapid convert-and-split strategy to frustrate tracing and freezing efforts.

Exchange responses and asset remediation

Binance announced it had reserved more than $6.34 billion to restore affected customer assets following the breach and started repurchasing stolen altcoins using Bitcoin, Ethereum and stablecoins. The exchange also pledged to use company resources and its Secure Asset Fund for Users (SAFU) to cover losses, while continuing forensic tracing in coordination with industry partners and law enforcement.

Sanctions, diplomacy, and Pyongyang's reaction

The rise in DPRK-linked crypto thefts has prompted multinational sanctions and public statements from several countries. A joint statement released by the European Union on Oct. 28 noted coordinated measures by the US, Australia and the EU targeting overseas labor revenue, malicious cyber activities and unlawful cooperation between North Korea and Russia. Eleven countries plus the EU signed the statement, urging UN members to implement existing Security Council resolutions.

Pyongyang publicly rejected those measures. State media outlets, citing an unnamed foreign ministry spokesperson, dismissed the sanctions push and framed it as ineffective pressure that ‘‘may work on the weak but never on us.’’ The diplomatic standoff underlines the geopolitical dimensions of crypto-enabled illicit finance and the challenge of enforcement across borders and decentralized systems.

What this means for crypto security and policymakers

Blockchain tracing firms say these incidents underscore the importance of robust on-chain analytics, stronger operational security at centralized services, and international cooperation on sanctions enforcement. For exchanges and custodial services, the evolving threat landscape — from credential compromises to sophisticated signing attacks — reinforces the need for layered security, hardware-backed key management, and rigorous transaction approval processes.

For policy makers, the scale and cross-border nature of attributed DPRK-linked thefts emphasize gaps in enforcement and the incentives that drive state-affiliated cybercrime. As investigators continue to monitor fund flows and remediate losses, the crypto industry and regulators will likely increase coordination on sanctions implementation, forensic tracing, and rapid response frameworks to limit the damage from future breaches.

Chainalysis' Oct. 30 figures provide a stark snapshot: a small number of highly capable actors can extract and launder billions from the cryptocurrency ecosystem, shifting how security teams, exchanges, and governments prioritize defenses against state-tied cybercrime.