North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026

Key takeaways

• North Korea-backed hackers have stolen about USD 12.8 billion in crypto across 100 incidents since 2017, and USD 7.4 billion of that in 2026
• North Korea accounts for 85% of all crypto hack value worldwide in 2026 year to date, up from 7% in 2020
• Most of the money comes from a few infrastructure compromises. Binance, Bybit, Ronin, Bitget, and DMM Bitcoin hacks account for USD 9.1 billion of the total USD 12.8 billion stolen by North Korea
• About USD 6.36 billion left Binance wallets across ten blockchains, most of it in about 20 minutes
• Stablecoin issuers and the Arbitrum Security Council froze nearly USD 2.7 billion after the Binance theft, and the USD 2.4 billion the attacker still holds is in assets with no issuer to freeze them
• The people behind the theft are reached through jobs, recruiters, and laptops, which makes offchain intelligence as important as the onchain trail

{{horizontal-line}}

Binance lost USD 6.36 billion in about 20 minutes

On October 29, 2026, about USD 6.36 billion left Binance wallets across ten blockchains, most of it in about 20 minutes beginning at 20:05 UTC. TRM attributes the theft to TraderTraitor, a North Korean state-sponsored unit, with high confidence based on robust on- and off-chain intelligence. Binance has confirmed a security incident and suspended withdrawals on several networks, and says user funds are safe. Binance has not published a root cause, and no government has attributed the theft.

It is the largest theft in crypto history, about four times the USD 1.5 billion taken from Bybit in February 2025. Preparation began at least 36 hours earlier, with small Tornado Cash withdrawals from October 28 that funded an operator wallet. The same preparation pattern appeared in the Bybit and KelpDAO thefts.

This post puts the Binance theft in context. It covers how much North Korea has stolen, what share of all hacking it represents, how it launders the money, how fast the funds move, why freezes matter, and what offchain intelligence adds.

North Korea's share of crypto hacking has risen every year since 2020

Crypto hacking has produced about USD 28 billion in losses, with 2026 year to date hitting USD 8.7 billion, the highest on record. The Binance theft accounts for most of that increase.

North Korea is one of the largest perpetrators of these hacks. As of October 2026, it is responsible for 85% of the total value hacked this year, with the vast majority resulting from the Binance hack. Last year North Korea was responsible for 63% of the funds stolen worldwide, and over the past five years it has accounted for 60% of all funds stolen.

North Korea steals by going after the people who control the keys

Attackers have many ways to take crypto. They can exploit a bug in a smart contract, manipulate a price feed, hijack a website, or take over the keys that control a wallet.

The most common method across all hackers is the smart contract exploit. Since 2022, code exploits have accounted for 49% of the incidents in TRM's data that have a classified attack type. In these attacks the hacker finds a flaw in a protocol's code and drains funds straight from the contract. They are frequent, but they account for only 15% of the value stolen since 2022.

North Korea works differently. Only 13 of its 100 attributed incidents are code exploits, and they add up to about 1% of what North Korea has stolen. Before Binance, about 76% of its stolen value came from infrastructure attacks, which target the keys, servers, and signing systems behind the money. Including Binance, the share is 88%. Without North Korea, infrastructure attacks are 21% of the value stolen by every other hacker combined.

North Korea reaches those systems through people. TRM's analysis describes the sequence as "Code to Custody." A fake recruiter or investor approaches a target and convinces them to download a coding test. The coding test delivers malware. The malware yields SSH keys, session cookies, and cloud tokens, and those lead to the systems that sign transactions. TRM's 2023 examples include Atomic Wallet, CoinsPaid, Alphapo, Stake.com, and CoinEx.

The same approach shows up in 2026. TRM analysts assess that North Korean proxies reportedly met Drift employees in person over several months before the April theft. In the KelpDAO theft, attackers poisoned two internal RPC nodes and overwhelmed the external ones with traffic. At Binance, the attacker used 50 pre-signed authorizations on Ethereum, and TRM assesses the attacker likely gained the ability to make Binance's hot-wallet signing system sign across chains. None of these thefts needed a bug in a smart contract.

North Korea reuses a familiar laundering playbook

North Korea's success in stealing crypto does not guarantee it can cash out. That depends on moving the proceeds before stablecoin issuers freeze the funds or exchanges identify and block the accounts used to convert them.

TRM has documented recurring methods across North Korean thefts, although the sequence and services vary by attack:

• Split the proceeds. Attackers distribute stolen funds across fresh wallets, often using peel chains that send portions onward through successive addresses. This creates multiple paths for investigators to follow and intermediaries to screen.
• Swap assets and move across chains. Attackers use decentralized exchanges, bridges, and swap services to convert the proceeds and move them between blockchains. THORChain handled much of this activity after the Bybit and KelpDAO thefts, allowing attackers to swap stolen assets into Bitcoin.
• Use mixers to obscure the trail. After Bybit, early batches of Bitcoin entered Wasabi and CryptoMixer. Mixing complicates the link between the stolen funds and their eventual destination, particularly when combined with repeated swaps and cross-chain transfers.
• Move toward cash-out through brokers. TRM has documented the use of TRON-based USDT, nested exchanges, and over-the-counter desks. Chinese over-the-counter and shadow-banking brokers buy stolen funds at a discount and handle much of the subsequent laundering.

The Binance proceeds have so far followed a different route from the bridge-heavy activity seen after Bybit. TRM observed sales to market makers through intent-based contracts, borrowing against stolen collateral on Aave and JustLend, and sales through decentralized exchanges.

The attacker still holds more than 420,000 ETH and 18,270 BTC, worth about USD 2.4 billion. TRM expects bridges, swap services, and over-the-counter brokers to feature in subsequent laundering, but those movements have yet to occur.

Nearly USD 2.7 billion of the Binance theft was frozen

Stablecoin issuers can freeze tokens they issued, and exchanges can freeze deposits. Native assets such as Bitcoin and ETH have no issuer, so once funds are converted, nobody can freeze them. The window to freeze is the time between theft and conversion, and North Korea's laundering sequence is built to close it.

As of 00:30 UTC on October 30, TRM reported that nearly USD 2.7 billion had been frozen, about 42% of the total.

• Tether froze about 1.77 billion USDT
• Circle froze about 825 million USDC
• Ripple froze 40.5 million RLUSD, and about 48 million RLUSD had been sold before the freeze
• World Liberty Financial froze 27.8 million USD1
• The Arbitrum Security Council froze about USD 30 million

Meanwhile the attacker still controls about USD 2.4 billion in ETH and BTC that no issuer can freeze. The stablecoin portion could be frozen because the issuers acted within hours. The portion that was swapped before the freezes, or held in native assets, could not.

Earlier cases show the same trade-off. After the Arbitrum Security Council froze about 30,766 ETH (about USD 75 million) in the KelpDAO theft, TRM reported a rapid laundering push by the attacker. In the IT worker cases, Tether froze wallets at the request of US law enforcement, including wallets tied to the USD 7.7 million forfeiture action the Department of Justice filed in June 2025. Tether also blocklisted much of the USD 5.4 million at addresses OFAC listed in November 2025.

Issuers and exchanges can only act on addresses they know about, so the time between theft and freeze depends on how quickly they learn which addresses are tainted. Real-time alerts shorten that gap, and the TRM Beacon Network delivers them.

Offchain intelligence links the wallets to people

The onchain trail ends where funds reach a broker, an exchange account, or a mixer. North Korea's IT worker program offers a well-documented off-chain view of who sits behind these accounts.

Operatives apply for remote jobs under stolen or fabricated identities, often backed by falsified documents. KnowBe4 hired one such worker unknowingly, and Vidoc Security recorded two deepfake-assisted job applicants. TRM analysts note that these workers seek jobs at AI-focused companies.

These operatives also depend on people and equipment inside a target country. On October 13, 2026, the Department of Justice announced an indictment in the Northern District of Ohio. It describes that, from 2019 to about July 2025, 10 China-based defendants used stolen or fabricated identity documents, VPNs, and proxy infrastructure to land remote jobs at more than 70 US companies. US-based facilitators allegedly hosted company laptops at their homes. The release says the scheme generated more than USD 3 million in revenue that is believed to have gone to sanctioned North Korean entities. These are allegations until proven in court. In September, the FBI searched more than 40 suspected laptop-farm residences in Texas and seized about 187 laptops and KVM devices, and arrested two US nationals. Each laptop host, account, and shell company is a point where offchain records can connect to onchain payments.

Onchain payments provide the link between the workers and the state. TRM's analysis of the OFAC action of November 4, 2025 found more than USD 12.7 million received by wallets tied to Cheil Credit Bank between June 2023 and May 2025, including inflows that appear to be salary-like payments from IT workers. In the OFAC action of October 28, 2026, TRM identified direct USDT transfers from Amnokgang-attributed addresses to one of the designated facilitators.

Offchain leads change how the onchain trail is read. A wallet that looks like a user wallet becomes an IT-worker payment address once a DOJ filing names it, and a deposit at an exchange becomes a freezable account once the exchange knows who the customer is.

Sanctions and enforcement timeline

Since the February 2025 Bybit theft, US authorities have taken action against North Korean bankers and front companies, as well as facilitators tied to North Korean crypto theft and IT worker schemes. Several of these actions, including OFAC designations in November 2025 and October 2026, list crypto addresses that regulators and screening teams can act on. Figure 1 sets those actions alongside the two largest thefts attributed to North Korea over the period.

What compliance and security teams can do

• Screen against labeled addresses. Run deposits and counterparties against TRM's North Korea labels and rescreen as new attributions are added
• Screen several hops downstream. TRM expects the Binance proceeds to pass through bridges, swap services, and over-the-counter brokers before cash-out
• Watch for delegations and signing changes. TRM recommends monitoring for EIP-7702 delegations and separating signing infrastructure by chain
• Have market makers screen counterparties. Binance proceeds were sold through market makers and intent-based contracts
• Join real-time alerting. Freezes depend on how fast an issuer or exchange learns an address is tainted, and the TRM Beacon Network delivers alerts to members
• Add hiring controls. Verify identities and locations of remote hires, and review payments to workers for round, repeating amounts to newly opened accounts

To screen for North Korea exposure and trace stolen funds across chains, request a TRM demo.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. How much crypto has North Korea stolen?

About USD 12.8 billion across 100 incidents since 2017 in TRM's data through October 29, 2026. USD 7.4 billion of that was stolen in 2026, mostly in the Binance theft.

2. What share of crypto hacking is North Korea responsible for?

In 2026 year to date, North Korea accounts for 85% of all crypto hack value. The share was 63% in 2025, 39% in 2024, and 7% in 2020. Excluding Binance, the 2026 share is 45%.

3. How does North Korea launder stolen crypto?

The typical sequence starts with Tornado Cash withdrawals to fund the operator wallet. It continues with a fast split across fresh wallets and peel chains, swaps and bridges into Bitcoin (mostly through THORChain after Bybit and KelpDAO), mixers, and cash-out through over-the-counter and brokerage networks, including Chinese brokers.

4. How fast does the money move?

About USD 6.36 billion left Binance across ten blockchains in about 20 minutes. At least USD 160 million of the Bybit proceeds moved within 48 hours. Some funds then sit for weeks, such as the ETH stolen from Drift.

5. Why do freezes matter?

Stablecoin issuers and exchanges can freeze tokens and deposits only while the funds remain in a freezable form. Nearly USD 2.7 billion was frozen after the Binance theft, about 42% of the total. Assets that are converted to Bitcoin or ETH cannot be frozen by an issuer.

6. Who has been sanctioned for North Korean crypto theft and IT worker schemes?

OFAC designated bankers and front companies in November 2025, listing 53 crypto addresses, and designated 10 individuals and one entity that facilitate IT worker schemes on October 28, 2026. The Department of Justice has filed forfeiture actions and indictments tied to the IT worker schemes. Indictments are allegations until proven in court.

7. Is North Korea behind the Bitget theft?

TRM has not definitively attributed the Bitget theft, and this post counts it as a North Korean attack. Bitget's CEO has said North Korea is very likely responsible, and TRM reports laundering wallets that overlap with the Bybit and AFX Bridge thefts, which point to TraderTraitor. Another actor remains technically possible.