Crypto has a hacking problem. Increasingly, that problem traces back to Pyongyang.

Suspected North Korea-linked hacks accounted for nearly 89% of reported cryptocurrency hack losses in 2026 so far, according to data published by blockchain analytics firm Chainalysis on October 30, 2026. In 2021, that share stood at just 15%. Average losses per attack have also more than tripled since 2021, underscoring that suspected DPRK operations now drive the overwhelming majority of stolen crypto.

That concentration is what sets 2026 apart for the industry: when one state-linked actor accounts for most reported losses, exchange security planning and incident tracking increasingly revolve around a single, well-documented threat profile rather than a diffuse field of attackers.

The Numbers Behind the Surge

Chainalysis tracked reported crypto hack losses from 2021 through October 29, 2026. Over that window, total reported losses came to an estimated $22.34 billion. Suspected DPRK-linked hacks made up an estimated $13.24 billion of that total, which works out to about 59% of all reported losses across the period.

The more telling figure may be the size of each attack. The average loss per suspected DPRK-linked incident was $50.65 million in 2021, per Chainalysis. In 2026 year-to-date, that average climbed to $185.65 million — making each attack more than three times as costly as it was five years ago.

Taken together, the data points to fewer, bigger strikes rather than a flood of small ones. The concentration of losses in a handful of major events, rather than a broad rise in hacking volume, suggests a deliberate focus on high-value targets. It also means single incidents can swing annual totals on their own — a dynamic visible in the two 2026 attacks below.

The Big Hits of 2026

Two incidents loom over the year's totals. The largest is a Binance hack on October 29, 2026, with losses estimated at roughly $6.3 billion to $6.4 billion. Earlier, in September 2026, an exploit on Bitget resulted in a loss of $387 million.

Both incidents have been linked to TraderTraitor, a North Korean cyber group tied to a string of high-value attacks.

The techniques involved are not brute-force code breaking. The attacks have relied on sophisticated methods such as social engineering, which targets people rather than software, and multi-chain laundering, which moves stolen funds across several blockchains to obscure the trail. Those entry points sit in operations and personnel rather than code alone — a recurring feature of the incidents attributed to the group so far.

A Second Opinion From TRM Labs

Chainalysis is not the only firm tracking the trend. Rival analytics company TRM Labs estimates North Korea's share of total hack value in 2026 at around 85%.

TRM Labs puts the regime's cumulative crypto theft since 2017 at approximately $12.8 billion to $13.5 billion. The firm estimates that $7.4 billion of that was stolen in 2026 year-to-date alone.

The two firms use different methods and time windows, so their figures do not line up perfectly. The direction, however, is the same: both show North Korea-linked activity dominating crypto theft this year. For readers weighing the numbers, that independent convergence is the key context — the headline totals vary by methodology, but the core finding is corroborated across two separate datasets.

How We Got Here

Back in 2021, North Korea-linked hacks were one threat among many. Chainalysis data puts their share of losses that year at 15%, meaning most stolen crypto went to other attackers.

Groups like TraderTraitor have since become repeat names in breach reports. The pattern has been consistent: target large platforms, exploit human access points, then launder the proceeds across multiple networks.

With year-end tallies still pending, the figures to watch are the next updates from Chainalysis and TRM Labs — both to see whether 2026's concentration holds through December and to see how each firm's methodology accounts for the Binance and Bitget incidents in final totals.