North Korea-linked hackers accounted for nearly 89% of reported cryptocurrency hack losses in 2026, according to findings published by Chainalysis on October 30. The finding followed the theft of approximately $6.3 billion from Binance in October, while Pyongyang separately rejected an international statement calling for stronger sanctions enforcement.

The Scale of This Year's Crypto Hack Losses

The company's figures include reported cases through October 29. Of the $22.34 billion lost to crypto hacks since 2021, about 59% — or $13.24 billion — is attributed to alleged North Korean cybercrime. Suspected North Korea-linked hacks account for nearly 89% of reported crypto hack losses so far this year, up from a 15% share in 2021. The average reported loss per suspected DPRK-linked hack rose from $50.65 million in 2021 to $185.65 million in 2026 year to date, roughly 3.7 times larger.

Suspected North Korea-linked hacks account for nearly 89% of reported crypto hack losses so far this year. In 2021, that share was 15%. The average reported loss per suspected DPRK-linked hack rose from $50.65M in 2021 to $185.65M in 2026 YTD, about 3.7x larger. From 2021… pic.twitter.com/zT4nFqqvWK

— Chainalysis (@chainalysis) October 30, 2026 (source post)

Chainalysis noted that these percentages reflect the value attributed to the attackers, rather than the actual number of cases or court findings. Because the figures cover reported cases only through October 29, the final year-end totals could still change as additional incidents are reported.

Why Are North Korean Crypto Hack Losses Increasing?

Chainalysis estimates that the average value of a crypto hack associated with North Korea rose to $185.65 million in 2026 from $50.65 million in 2021, a 3.7-fold increase. The firm earlier estimated the value of crypto stolen by North Korean hackers at $2.02 billion in 2025, up 51% compared with 2024 because of fewer attacks but larger incidents.

One such large incident was the February 2025 breach of Bybit, which caused losses of approximately $1.5 billion. According to Chainalysis, the three largest cyber incidents accounted for 69% of losses from cryptocurrency services in 2025.

Researchers also described phishing scams and remote IT employees attempting to gain access to crypto firms. Stolen signing privileges can allow attackers to withdraw funds without exploiting any vulnerability in the blockchain protocol itself.

This year's figures have been strongly shaped by the October breach of Binance, in which the exchange reported about $6.3 billion in unauthorized withdrawals.

How Was the Binance Hack Traced?

Chainalysis connected the hack to TraderTraitor, a threat actor it categorizes as belonging to North Korea. The firm said it tracked the movement of funds from Binance and identified links to funds stolen in the Bitget hack in September, an incident the company also believes was carried out by actors operating in North Korea. Chainalysis described this as its strongest evidence to date, but it has yet to determine how the attacker obtained the necessary signature authorization. Binance has not released its technical explanation of the matter. (Source: Finance Magnates) How the attacker obtained that signature authorization remains the central unresolved question in the case.

TRM Labs independently confirmed that the heist belongs to TraderTraitor. Its October 30 report indicated that a total of $6.36 billion was transferred across ten different networks in 20 minutes. TRM Labs also found that North Korea was responsible for 85% of crypto hack losses in 2026.

Where Did the Stolen Assets Go?

Chainalysis noted that thousands of transactions moved back and forth between addresses. These addresses began by receiving one TRX before receiving larger sums and sending the funds out again. According to investigators, this repetitive behavior indicated automated laundering following the hack. However, they were unable to determine who programmed the software or the method used for the initial compromise.

The hacker transferred $500 million worth of stablecoins to conversion routes. In less than 20 minutes, almost $325 million worth of them were converted into $285 million worth of ETH, while $175 million was kept in intermediary wallets.

Stablecoin issuers and their industry partners have frozen close to $2.8 billion, according to Chainalysis. TRM Labs' earlier snapshot reported the freezing of almost $2.7 billion, reflecting different points in the reporting process. Freezing stablecoins can stop them from moving until their conversion. Native bitcoin and Ethereum have no issuer and therefore cannot be frozen, making time essential when investigating hacks involving these assets. Whether more of the stolen funds can be frozen before they are converted remains an open question.

Why Did Pyongyang Reject the Sanctions Statement?

On October 31, North Korea dismissed multilateral attempts to enforce sanctions against its activities beyond its borders. The country's foreign ministry stated that sanctions and pressure would not affect its nuclear armaments policy, according to state-run media.

An open letter from 11 nations and the European Union, released on October 28, referred to overseas workers, cyberspace operations, and military cooperation with Russia. It appealed to United Nations member states to enforce already adopted Security Council resolutions. The signatories drew a connection between sanctions policies and the financing of illicit arms programs.

The diplomatic letter did not name any of the parties responsible for the Binance cryptocurrency theft. The findings by Chainalysis and TRM Labs can be considered investigative attribution. For now, attribution of the October theft comes from private-sector analysis rather than from any formal designation by the governments behind the letter.