Chainalysis Report: North Korean Hackers Responsible for Majority of Cryptocurrency Theft in 2026

North Korean Cybercriminals and Cryptocurrency Hacks

More than 89% of the total losses from cryptocurrency hacks reported this year can be traced back to cybercriminals affiliated with North Korea, according to findings released by Chainalysis on October 30. This alarming statistic comes as the North Korean government continues to disregard international sanctions aimed at curbing its revenue streams and advancing its military capabilities. The data reflects losses documented up until October 29, 2026, marking a significant increase in the role of North Korean hacking operations in the global cryptocurrency landscape.

Significant Financial Impact

Since 2021, these suspected operations have caused a staggering total of $13.24 billion in losses, out of a cumulative $22.34 billion, signifying around 59% of the reported hacking losses in that timeframe. This dramatic rise in the hackers' share is a stark contrast to the 15% reported in 2021, indicating a 74 percentage point increase. On average, each North Korea-related cyber attack now results in losses approximately 3.7 times greater than that of earlier attacks.

Previous Assessments and Theft Estimates

In a previous assessment for 2025, Chainalysis reported that North Korean hackers stole $2.02 billion, a figure that represented a 51% increase from the previous year despite fewer incidents being reported. The firm estimates that by 2025, the total theft by these actors reached a staggering $6.75 billion.

Methods of Operation

The report highlights various methods employed by these hackers, such as infiltrating cryptocurrency businesses with IT specialists and executing impersonation tactics aimed at executives. Major targets have included essential processes like transaction signing and private key infrastructures, where legitimate signers were duped into approving fraudulent transactions. A notable case involved the Bybit incident in February 2025, which alone accounted for a loss of $1.5 billion.

Recent Breaches and Investigations

Following a recent breach of Binance on October 29, investigators have suggested that a single incident could exceed $6 billion in losses. Binance itself estimated the financial impact of this breach at approximately $6.3 billion, affirming its commitment to compensating users from its own resources and its Secure Asset Fund for Users. Chainalysis attributed this theft to a North Korean group named TraderTraitor, observing how the stolen funds were intermingled with those acquired from a previous exploit on Bitget, again tied to North Korean cyber operations.

TRM Labs also corroborated the involvement of TraderTraitor in the Binance attack, providing high confidence in their findings based on intelligence collected from both blockchain and other sources, valuing the outflows at approximately $6.36 billion. Preparations for this operation reportedly commenced at least 36 hours prior, involving various tactical rehearsals and minor withdrawals from Tornado Cash.

Patterns of Asset Movement

After the hacking incident, evident patterns emerged where the stolen assets circulated between multiple cryptocurrency addresses, hinting at an automated scheme to distribute the stolen funds. During an urgent attempt to escape asset freezes, $500 million in stablecoins were redirected to various wallets, with millions being converted to Ethereum shortly thereafter. Binance later confirmed that it has set aside over $6.34 billion to reclaim affected assets while also initiating buybacks of stolen altcoins using cryptocurrencies like Bitcoin and Ethereum.

North Korea's Response to Sanctions

In a separate statement issued on October 31, a spokesperson from North Korea's foreign ministry rejected a coalition's efforts to enforce sanctions, emphasizing that such measures would not impact their operations. This commentary followed an October 28 declaration from the European Union, listing the US, Australia, and other nations that have imposed sanctions on North Korea for its cyber activities and alliances with Russia amid ongoing tensions surrounding its nuclear ambitions. The collective statement urged all UN members to adhere to existing Security Council resolutions.