Attackers the FBI has tied to North Korea stole $6.36 billion from Binance hot wallets (internet-connected wallets that exchanges hold for day-to-day operations) on October 29, according to research published by Crypto Briefing on November 10, 2026. The figure, attributed to blockchain analytics firm TRM Labs, is equivalent to roughly 13.6 times North Korea's 2025 goods exports, while data from analytics firm Elliptic shows the attackers dispersed the funds through approximately 12,000 wallets across 11 chains within 3.5 days.

The research, based on data as of November 4, 2026, combines two analyses in a single report: an account of how the theft unfolded, and a tracing of where the stolen assets are going and what they are being converted into. Its opening section sizes up the theft — what was taken, how it compares with North Korea's economy, and how widely the attacker spread it. It then examines which assets freezes stopped, which survived, what became of North Korea's last theft above $1 billion, and what the pattern suggests about flows from future hacks.

Key findings

Freezes caught most of the stolen stablecoins and none of the bitcoin. The two asset classes differ structurally here: stablecoins can generally be frozen by their issuers, while bitcoin has no comparable centralized freeze mechanism. The report breaks down the split by asset type and quantifies how much of the stolen funds the attacker sold before the first freeze took effect.

Roughly 584,000 ETH and 18,270 BTC survived. The report traces where those holdings are sitting and identifies the wallet movements that would signal them heading to market.

One token has carried more of the price risk than ETH or BTC since the hack. The report measures it against four other exchange tokens.

North Korea's thefts have grown every year since 2023. The report charts that trend and what it suggests about which assets will absorb the flows from the next large hack.

Full report access

The complete report is available through Crypto Briefing Pro, the newsroom's subscriber app. The research is presented as information, not investment advice.

Disclosure: the article was edited by Diego Almada Lopez, and details of the outlet's content creation and review process are set out in its Editorial Policy.