North Korean Hackers Stole $7.61 Billion in Crypto in 2026 Without Breaking Code

North Korean hackers amassed an estimated $7.61 billion across 38 incidents between January and October, according to blockchain intelligence firm BitOK. The crypto theft figures for 2026 were published on November 6 alongside data showing $2.86 billion in funds recovered through freezes and seizures.

The report highlights a fundamental shift in attack methodologies. In the six largest incidents, the perpetrators did not need to exploit vulnerabilities in smart-contract code. Instead, they compromised employees, signing devices, and withdrawal systems—the operational infrastructure that allows transactions to pass standard verification checks.

What Happened: North Korean Hackers Crypto Theft 2026 Count

What does BitOK’s 2026 estimate include?

Between January and October 2026, BitOK recorded 38 incidents attributed to North Korean hackers. The total encompasses thefts targeting exchanges, decentralized finance (DeFi) platforms, and other cryptocurrency businesses, with the six largest attacks responsible for the vast majority of the financial losses.

These figures represent cumulative stolen assets rather than a single transaction or coordinated event. While the report connects the various incidents through shared laundering patterns, it leaves open the possibility that multiple independent teams executed the individual intrusions.

How much crypto was recovered?

Per BitOK, freezes and seizures successfully intercepted $2.86 billion, leaving $4.75 billion out of reach. Recovery efforts proved most effective when stolen funds remained in stablecoins or were held by services capable of blocking transfers.

Binance alone accounts for $6.41 billion of the overall reported total. BitOK also detailed 32 smaller thefts totaling $178.4 million. Because these categorical sums do not align with the stated $7.61 billion aggregate estimate, the report treats them as independent figures rather than elements of a revised total.

Who Is Behind the Attacks: Shared Laundering Links, Different Teams

Why are the incidents attributed to North Korea?

The actors behind these operations are identified as North Korean hackers. Chainalysis previously linked the Bitget theft to North Korea in October, establishing an earlier connection for an incident that fits into this broader pattern.

This attribution is based on suspected associations and operational methods rather than the public identification or charging of specific individuals. No suspects have been formally named or convicted in connection with the 2026 incidents.

What connects five attacks?

BitOK identified shared settlement addresses across five distinct attacks, ranging from the KelpDAO theft in April to the Binance incident in October. These addresses were utilized while the stolen funds were transferred and laundered, providing investigators with a common thread linking otherwise separate cases.

According to the report, this trail points to a single laundering entity. However, because different operational teams may have executed the initial hacks, the precise relationship between the intruders and the laundering service remains undetermined.

Background: How Attackers Reached Signing Systems

What was the Binance entry point?

BitOK reported that the breach at Binance involved a DevOps engineer’s laptop and a signing-service container. The attackers leveraged this access to manipulate the systems that approve withdrawals, bypassing any need to exploit flaws in the underlying blockchain.

This distinction is critical. The resulting transfers bore valid signatures and successfully cleared standard verification checks. A transaction can appear fully authorized at the protocol level even when the individual or device approving it has been compromised.

Which other systems were targeted?

Similar tactics appeared across other major incidents. Attackers compromised multisig signers at Drift (a Solana-based trading platform), a single bridge verifier at KelpDAO, and the wallet architecture at Bitget.

All of these components operate close to the point where assets leave a platform. By gaining control over a signer, verifier, or wallet process, malicious actors can generate what appears to be an authorized withdrawal without ever touching the blockchain’s underlying code.

How did operators prepare?

Prior to executing each theft, the operators tested their transfer routes using nominal amounts. The attack contract deployed against Binance, for instance, went live publicly four hours before the major theft, allowing the attackers to verify their planned pathway.

The timing data also highlighted a distinct operational schedule. Out of a sample of 540 transactions, 48% took place between 4 p.m. and 9 p.m. Pyongyang time. Conversely, Saturdays, Sundays, and Mondays collectively accounted for only 10% of the activity in that sample.

Why It Matters: Freezes Can Lose the Race

Why did attackers move assets into ETH?

Minutes after executing an attack, the operators converted stablecoins into Ether (ETH) or borrowed ETH using stolen collateral. This rapid maneuver neutralized issuer-level freezes, as no single token issuer possesses the authority to freeze ETH.

This swift conversion drastically compressed the window of opportunity for exchanges, token issuers, and investigators to intervene. Once funds propagated across additional services and blockchain networks, tracking and recovering them became significantly more difficult.

How quickly did funds leave after the rsETH bridge exploit?

Following the April rsETH bridge exploit, the initial 52,440 ETH was extracted from lending protocols in slightly over eight minutes. These funds then remained dormant for 2.5 to 5 days before automated scripts routed them through THORChain, a cross-chain liquidity protocol.

This operational pause did not necessarily simplify asset recovery; rather, it provided the operators time to distance themselves from the initial lending platforms before initiating a secondary laundering phase.

How late was the first Binance freeze request?

Tether received its initial freeze request 34 minutes after the illicit Binance withdrawal occurred. By that time, 345 million USDT had already departed the originating address.

Despite this delay, Binance achieved a higher recovery rate than other major attacks evaluated by BitOK, and the company has since covered the majority of user losses using its own reserves.

The Numbers: Recovery, Timing and Laundering Costs

How did Binance compare with other major attacks?

BitOK reported that 43% of the funds stolen during the Binance attack were successfully frozen or seized. By contrast, the combined recovery rate across the remaining major attacks stood at just 6%.

Fast responses and the use of stablecoins accounted for this disparity. Assets that remained within the control of an issuer or platform could be blocked, whereas ETH and other assets moved outside an issuer’s direct jurisdiction proved much harder to reclaim.

What did the laundering cost?

Across 2,257 Binance-linked swaps valued at $55.8 million, aggregate laundering costs amounted to 0.50%. This low overhead allowed the operators to move substantial sums without transaction fees serving as a meaningful barrier.

These swaps supported a broader laundering architecture comprising cross-chain transfers, lending protocols, and privacy tools. While immediate movement was required for initial withdrawals, subsequent laundering steps were fully automated.

What routine did BitOK observe?

The transaction sample revealed that activity was heavily concentrated within a five-hour window in Pyongyang, while weekends and Mondays remained comparatively quiet. Public holidays similarly showed no recorded activity in the sampled data.

Once an attack commenced, however, this pattern shifted entirely. Automated scripts transferred funds around the clock, ensuring that the laundering process continued long after the initial compromise concluded.

Dust Trails and the 0.27 ETH Link

What happened on August 31?

After routing 5,047 ETH through Umbra (a stealth-address privacy tool) and the Stargate bridge, the operators swept remaining dust balances into a single collector wallet. On August 31, 150 addresses emptied their residual funds into that collector within a span of 3 minutes and 36 seconds.

Although the collector received a mere 0.27 ETH—a negligible sum compared to the total stolen assets—the recurring residual balances established a definitive link between addresses associated with separate incidents.

Which attacks did the trail connect?

BitOK stated that this sweeping activity connected the AFX theft with the August 28 theft, while Bitget-related addresses joined the pattern in September. Subsequent shared settlement addresses linked five total attacks, including KelpDAO in April and Binance in October.

For attribution purposes, these minuscule leftover amounts proved more valuable than the primary movements routed through exchanges and bridges. Operational oversights can betray attackers even when principal funds are successfully fragmented across numerous services.

Risks and Open Questions in the Attribution

Does one laundering address mean one hacking team?

Not necessarily. While BitOK’s analysis points to a single laundering operator, the report explicitly allows for the possibility of distinct teams executing the underlying hacks. Shared addresses connect specific phases of money movement without confirming that a single crew perpetrated every intrusion.

This distinction is essential when evaluating incidents at Binance, Drift, KelpDAO, Bitget, and other targets. Similar tactics may indicate shared expertise, replicated procedures, or the use of a common third-party laundering service rather than a unified operational organization.

Why are signing systems now a major risk?

The report’s primary security takeaway is that the primary vulnerability has shifted away from smart contracts and toward employees, devices, and signing services. No automated code audit can catch a compromised laptop or a hijacked withdrawal approval workflow.

Organizations utilizing multisig wallets, bridge verifiers, and automated signing containers face risks that extend far beyond on-chain smart contract code. An attacker armed with legitimate credentials can make an unauthorized transfer appear completely routine.

What Happens Next for Crypto Security

What security focus does BitOK identify?

According to BitOK, signing keys—along with the personnel and infrastructure controlling them—must become the focal point of future security measures. Exchanges and DeFi protocols will need to monitor the devices, software containers, and authorization pathways that precede a transaction reaching the blockchain.

Minor residual balances warrant close observation as well. Although the 0.27 ETH collector held none of the primary proceeds, it successfully tied together addresses from five separate attacks.

<

What can platforms learn from the recovery figures?

Rapid detection and prompt engagement with token issuers yield tangible results. Binance successfully froze or seized 43% of the funds involved in its breach, compared to just 6% across other major incidents.

This contrast establishes a clear operational priority: detect unusual withdrawals swiftly, issue freeze requests immediately, and track initial token swaps the moment a signing mechanism is compromised. Once stablecoins are converted into ETH or routed through cross-chain protocols, recovery options diminish rapidly.

Users should also heed this lesson. A transaction that appears valid does not guarantee that the underlying withdrawal process was secure; it may have cleared every technical validation check while the signing environment itself remained under an attacker’s control.

?FAQ

01When did the incidents in BitOK’s count take place?

BitOK’s estimate covers incidents occurring between January and October 2026. The report was published on November 6, 2026, and incorporates the October Binance attack.

02How many incidents did BitOK count?

The firm identified 38 incidents. Six major attacks formed the primary focus of its analysis, while 32 smaller thefts were cataloged separately.

03Which systems were compromised in the major attacks?

Reported targets included a Binance DevOps engineer’s laptop and signing-service container, Drift multisig signers, a KelpDAO bridge verifier, and Bitget’s wallet architecture. Withdrawals across the six largest attacks bore valid signatures or cleared standard validation checks.

04How much did freezes and seizures recover?

BitOK estimated that freezes and seizures recovered $2.86 billion, while placing unrecovered losses at $4.75 billion.

05What was the Binance attack entry point?

The initial entry point comprised a DevOps engineer’s laptop paired with a signing-service container, which the attackers utilized to manipulate the withdrawal-signing workflow.

06Why did the first freeze request come too late?

Tether received its initial freeze request 34 minutes after the Binance withdrawal was initiated. By that time, 345 million USDT had already moved out of the originating address.

07What does a shared settlement address show?

It indicates that residual balances originating from different attack-associated addresses were routed through a common collector or settlement path. BitOK leveraged these connections to link five separate attacks and identify what it characterized as a single laundering operator.

This article is for information only and is not financial advice.