North Korean-linked hacking groups have accounted for 85 percent of all cryptocurrency stolen in hacks during 2026, according to blockchain intelligence analysis covering activity through October 29. The total attributed to these actors stands at $7.4 billion, out of $8.7 billion lost globally in the same period.

The figure marks a sharp rise from previous years. North Korea’s share of stolen crypto was 7 percent in 2020, remained under 10 percent in 2021, then climbed to 22 percent in 2022, 37 percent in 2023, 39 percent in 2024 and 63 percent in 2025. Cumulative thefts linked to the country since 2017 have reached $12.8 billion.

Major 2026 Incident and Attribution

The bulk of the 2026 total stems from an October 29 breach at a major exchange in which roughly $6.36 billion left wallets across ten blockchains. Most of the transfers occurred within about 20 minutes beginning at 4:05 p.m. Eastern Time. Analysts attribute the incident with high confidence to a group known as TraderTraitor, previously linked to other large thefts.

Without that single event, North Korea-linked activity would have represented about 45 percent of global crypto-hack losses for the year. The attackers used 50 pre-approved Ethereum transaction authorizations and gained access to the exchange’s hot-wallet signing system.

U.S. authorities have previously tied the Lazarus Group to the $620 million Ronin Network breach in 2022 and have used the TraderTraitor designation for operators behind thefts at several platforms. These actors are reported to operate under North Korea’s Reconnaissance General Bureau. Governments state that proceeds support weapons and missile programs.

Shift Toward Infrastructure Attacks

Analysis shows North Korean-linked groups rarely rely on smart-contract code exploits. Of roughly 100 incidents attributed to them, only 13 involved such exploits, representing about 1 percent of the total value stolen. Instead, attackers focus on people, private keys, internal servers and the systems that control access to funds.

One recurring approach begins with fake recruiters or investors contacting developers or employees and persuading them to download malware disguised as coding tests or other files. Once installed, the malware can capture credentials, keys and cloud tokens, allowing entry into systems that approve transactions. In other cases, operators compromise internal infrastructure directly, such as RPC nodes.

After the October exchange incident is included, infrastructure attacks account for 88 percent of the value stolen by these groups in 2026. Across the wider industry since 2022, smart-contract attacks have made up nearly half of recorded incidents but only 15 percent of total losses.

Movement of Stolen Assets

Stolen funds are typically split across multiple new wallets and moved through peel-chain transfers of smaller amounts. Operators swap assets on decentralized exchanges and bridges, sometimes converting large volumes into Bitcoin via protocols such as THORChain. Mixing services further obscure trails before funds reach brokers or smaller platforms that facilitate conversion to cash.

In the October exchange case, some assets were sold through market makers and trading contracts. The operators also used stolen tokens as collateral to borrow on lending platforms. As of an October 30 update, the attackers still controlled more than 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion.

Stablecoin issuers and other platforms froze about $2.7 billion, or 42 percent of the stolen amount in that incident. Freezes included approximately $1.77 billion in USDT, $825 million in USDC, 40.5 million RLUSD, $27.8 million in USD1 and about $30 million on one network. Bitcoin and Ethereum cannot be frozen in the same centralized manner once transferred.

Historical Pattern and Wider Activity

North Korean cyber operations extend beyond cryptocurrency. Past incidents attributed to the same networks include the 2014 Sony Pictures attack, the 2016 $81 million theft from Bangladesh’s central bank, the 2017 WannaCry ransomware campaign that affected hundreds of thousands of computers, and breaches involving NASA and U.S. Air Force facilities detailed in a 2024 indictment.

Despite repeated sanctions and indictments, the volume and frequency of crypto-related attacks linked to the country have not declined. The rising share of global losses continues a multi-year trend documented in successive annual figures.

Industry participants continue to face pressure to strengthen internal access controls, monitor signing systems and verify personnel, while individual holders are advised to protect private keys, use hardware wallets where appropriate and scrutinize unexpected contacts or software requests.