North Korea crypto theft has reached roughly $12.8 billion since 2017 — with $7.4 billion of it stolen in 2026 alone, according to a TRM Labs report published October 30. This year’s haul includes the record $6.36 billion drained from Binance on October 29, the largest crypto theft in history.
TRM’s numbers make for grim but necessary reading: 100 incidents since 2017, and the pace is accelerating. More than half of everything North Korea has ever stolen from crypto users was taken this year alone.
100 incidents, one very productive year
Per TRM’s data through October 29, the cumulative North Korea crypto theft total stands at approximately $12.8 billion across 100 incidents. The $7.4 billion stolen in 2026 means this single year accounts for well over half the lifetime total — a pace no previous regime year has matched.
The concentration is just as striking. Including the Binance job, North Korean-linked actors are responsible for roughly 88% of the group’s 2026 haul in a single event, and Chainalysis separately told CNN it has “high confidence” North Korea was behind the exchange breach.
The Binance job: $6.36 billion in about 20 minutes
According to TRM, approximately $6.36 billion left Binance wallets across ten blockchains on October 29, with most of the outflow executed in roughly 20 minutes starting at 20:05 UTC — about four times the size of the $1.5 billion Bybit hack of February 2025.
TRM attributes the attack to TraderTraitor, North Korea’s state-sponsored unit analysts tie to the wider Lazarus Group, with high confidence based on on- and off-chain intelligence. Several operational features reportedly mirror earlier North Korea-linked heists, including Bybit and KelpDAO.
We covered the hack and the freeze response as it unfolded; TRM’s report is the first full post-mortem from a blockchain intelligence firm.
$2.7 billion frozen — but the clock is ticking
Stablecoin issuers and other entities have frozen approximately $2.7 billion of the stolen funds so far. TRM notes freezing matters because North Korean actors move money quickly — and the exchange itself has set aside $6.34 billion in company funds to cover user losses while it targets a withdrawal restart.
Two caveats worth stating plainly: TRM’s attribution is a private firm’s analytic judgment, not an official government attribution, and Binance has not yet published a root cause. The US has said publicly it is examining the incident and its North Korea links.
Why the North Korea crypto theft problem keeps growing
TRM’s framing is blunt: North Korea targets the people who control the keys, and organizations keep giving them openings — this time reportedly via a compromised DevOps engineer’s laptop. Chainalysis data cited in industry coverage puts North Korea-linked hacks at about 89% of reported crypto hack losses in 2026, up from 15% in 2021.
The strategic question for the industry is no longer whether the next attempt comes, but whether key-management practices improve faster than the adversary’s playbook. So far, 2026 says the adversary is winning that race.
Sources: TRM Labs reports, October 30, 2026; Chainalysis via CNN; supporting coverage from CBS News and Reuters.
