North Korean hackers stole an estimated $7.61 billion across 38 incidents between January and October — an average of roughly $200 million per incident — according to a report published on November 6 by blockchain intelligence firm BitOK. The firm said the six largest attacks did not require breaking smart-contract code. Instead, attackers took control of employees, signing devices and withdrawal systems.

BitOK counted thefts from exchanges, decentralized finance platforms and other crypto businesses. Of the estimated total, $2.86 billion was caught through freezes and seizures, while $4.75 billion — roughly 62% of the estimated total — remained beyond reach. The figures describe many separate incidents rather than a single transaction or one coordinated attack.

Signing Systems Became the Key Attack Surface

The report identifies the systems that authorize withdrawals as a primary target. In the case of Binance, BitOK said, attackers used a DevOps engineer's laptop and a signing-service container. The resulting transfers carried valid signatures or passed standard checks, even though the signing environment had been compromised — for the blockchain, a properly signed withdrawal is valid regardless of who controlled the device that produced it.

Other incidents involved multisig signers at Drift, a bridge verifier at KelpDAO and Bitget's wallet system. BitOK said attackers tested routes with small amounts before executing larger thefts. In the Binance case, the attack contract was publicly active four hours before the larger theft occurred.

The report also describes a rapid move from stablecoins into ETH, an asset that issuers cannot freeze. Tether received its first freeze request 34 minutes after the Binance withdrawal; by that point, 345 million USDT had already left the original address. BitOK said 43% of the funds stolen in the Binance attack were frozen or seized, compared with 6% across the other major attacks combined.

Shared Trails Connect Separate Incidents

BitOK said shared settlement addresses linked five attacks, spanning from the KelpDAO theft in April to the Binance incident in October. The firm traced residual balances that ended in a collector wallet. On August 31, 150 addresses emptied into that collector within 3 minutes and 36 seconds, leaving 0.27 ETH behind.

The firm interpreted the shared trail as evidence of a single laundering operator, while allowing that different teams may have carried out the intrusions. The report does not identify any individuals charged or convicted over the 2026 incidents, leaving the relationship between those who gained access and those who moved the funds unresolved.

BlockTelegraph previously reported on Binance outflows after the hack, including the exchange's reported $4.7 billion in net outflows after withdrawals resumed. Another report examined the wallet permissions tied to Binance wallets. Its coverage of Bitget detailed the zero-day linked to the theft.

Recovery Depends on Early Intervention

BitOK's figures show how timing shaped recovery outcomes. Stablecoins or assets held at a service able to block transfers offered a chance to stop movement. Once attackers converted funds into ETH or routed them through other services and chains, recovery became significantly harder, according to the report.

The report's next security focus is on signing keys and the people or systems that control them. It points to employee devices, containers and approval paths as part of the security boundary before transactions reach a blockchain. The account also highlights the value of small leftover balances: the 0.27 ETH collector helped connect addresses associated with separate attacks.

BitOK's 2026 estimate covers incidents through October and was published on November 6. The report presents shared laundering links as a way to connect money movements while leaving open whether the separate intrusions came from one team. Its account places rapid detection and freeze requests among the response measures that shaped what could ultimately be recovered.