North Korean Hackers Stole $7.4B in Crypto in 2026: Here’s How They Did It

• North Korean hackers stole $7.4 billion in crypto in 2026, 85% of global crypto thefts.
• Hackers target employees, private keys, and internal systems rather than exploiting blockchain code.
• Investors can reduce risks with hardware wallets, 2FA, secure devices, and careful transaction checks.

North Korean hackers stole about $7.4 billion in cryptocurrency in 2026, accounting for 85% of all crypto stolen in hacks this year as of October 2026. 

Blockchain intelligence firm TRM Labs shared this finding in a Friday report that also includes the October 29 Binance incident, in which hackers stole about $6.36 billion.

The incident pushed total crypto hacking losses to a record $8.7 billion this year. North Korea was also responsible for 63% of stolen crypto in 2025 and about 60% of all crypto stolen over the past five years.

But the biggest concern isn’t just how much money hackers steal, but how they do it. 

TRM Labs found that North Korean hackers often avoid attacking blockchain code directly. Instead, they target employees, private keys, company servers, and security systems that control access to crypto funds.

How North Korean Hackers Steal Crypto

Before the Binance incident, about 76% of the money North Korean hackers stole came from infrastructure attacks. After including the Binance incident, that figure increased to 88%.

This is different from traditional smart contract attacks, where hackers find weaknesses in blockchain code and exploit them to steal funds.

Since 2022, smart contract attacks have made up 49% of recorded hacking incidents across all attackers but accounted for only 15% of the total money stolen.

North Korea has used just 13 code exploits across 100 hacking incidents linked to the country. These exploits accounted for only about 1% of its stolen funds.

One method TRM calls “Code to Custody” involves tricking crypto employees or developers into installing malicious software.

The attack often starts with a fake recruiter or investor contacting a developer or crypto employee. They then convince the target to download a coding test or another file containing malware.

Once installed, the malware can steal login credentials, security keys, and cloud access tokens. Hackers can use these details to enter company systems and access the tools used to approve crypto transactions.

In other cases, hackers attack a company’s internal systems directly instead of targeting employees.

For example, during the KelpDAO incident, TRM reported that attackers compromised two internal RPC nodes and flooded external nodes with traffic.

In the Binance incident, hackers used 50 pre-approved transaction authorizations on Ethereum and accessed the exchange’s hot-wallet signing system across multiple blockchains.

These attacks show that even crypto platforms with secure blockchain code are not completely safe.

How Hackers Move Stolen Crypto

According to TRM Labs, North Korean hackers use several methods to hide stolen crypto. First, they divide stolen funds between several new wallets. They also use a method called peel chains, where they repeatedly send smaller amounts of money to different wallets.

Next, they exchange the stolen cryptocurrency for other assets or move it between different blockchains using decentralized exchanges and crypto bridges.

For example, after the Bybit and KelpDAO hacks, attackers used THORChain to move large amounts of stolen funds and convert them into Bitcoin.

Hackers also use mixing services to make it harder for investigators to trace where the money came from and where it goes.

Eventually, some of the stolen funds reach brokers, smaller exchanges, and other services that help convert cryptocurrency into cash.

The Binance incident has taken a slightly different path. TRM found that the attacker sold some stolen assets through market makers and trading contracts. The attacker also borrowed money on Aave and JustLend, using stolen assets as collateral.

According to TRM’s October 30 update, the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion.

Follow us on X for real-time crypto updates. 

How $2.7 Billion of the Binance Theft Was Frozen

Despite the size of the Binance theft, stablecoin companies and other crypto platforms managed to stop a large portion of the stolen funds from moving. As of 00:30 UTC on October 30, approximately $2.7 billion, or 42% of the stolen funds, had been frozen.

Here is how much each company or organization froze:

• Tether: Approximately $1.77 billion in USDT.
• Circle: Approximately $825 million in USDC.
• Ripple: 40.5 million RLUSD. 
• World Liberty Financial: $27.8 million in USD1.
• Arbitrum Security Council: Approximately $30 million.

The reason some stolen funds can be frozen while others cannot comes down to the type of cryptocurrency involved.

Stablecoins such as USDT and USDC are controlled by companies that issue them. These companies can freeze tokens linked to suspicious activity. Crypto exchanges can also block deposits from wallets connected to theft.

Bitcoin and Ethereum are different. They do not have a central company that can freeze individual users’ funds. This means that once hackers exchange stolen stablecoins for Bitcoin or ETH, recovering or freezing the money becomes much harder.

That is why quick action and cooperation between blockchain investigators, exchanges, and crypto companies are so important.

How to Protect Your Crypto Wallet and Exchange Account

As crypto infrastructure attacks increase, investors must look beyond smart contract security to protect their assets from phishing, account takeovers, and compromised devices.

Here are seven practical security measures:

1. Protect your seed phrase and private keys. Never share them with anyone or enter them on websites accessed through unsolicited links. Legitimate support teams will never ask for your recovery phrase.
2. Use a hardware wallet. Keep long-term holdings offline and avoid storing all your assets in hot wallets connected to everyday applications.
3. Enable two-factor authentication. Use an authenticator app or hardware security key instead of SMS where possible. Enable withdrawal allowlisting and login alerts.
4. Beware of fake job offers and investment opportunities. Avoid downloading unfamiliar files, running strangers’ code, or opening suspicious repositories and software packages.
5. Keep devices and wallet software updated. Install security updates, download applications from official sources, and avoid suspicious browser extensions.
6. Separate your crypto holdings. Use different wallets for long-term storage, everyday transactions, and decentralized applications to limit potential losses.
7. Verify every transaction. Check wallet addresses, transaction amounts, and permissions before signing. Be cautious with unfamiliar token approvals.

North Korea’s Crypto Theft Problem Is Growing

The latest Binance incident demonstrates how attackers with access to critical signing infrastructure can steal enormous sums.

While investors must secure their wallets and devices, exchanges and crypto companies must also strengthen internal access controls, monitor signing systems, verify employees and contractors, and respond quickly to suspicious activity.

With North Korea-linked operations accounting for an estimated 85% of crypto theft value in 2026, stronger security practices across the industry are more important than ever.

Subscribe to our YouTube channel for the latest crypto news.

Related: Who’s Behind the $6.3B Binance Hack? Chainalysis, ZachXBT Point to North Korea