North Korea-linked hackers stole about $12.8 billion in cryptocurrency across 100 incidents since 2017, including $7.4 billion in 2026, according to an October 30 report by blockchain intelligence firm TRM Labs. Five major thefts involving Binance, Bybit, Ronin, Bitget and DMM Bitcoin account for $9.1 billion of the total, the firm says.
TRM estimates that North Korea accounted for 85% of the value stolen in cryptocurrency hacks worldwide in 2026, compared with 7% in 2020. The Binance theft accounts for most of the increase in global losses this year, according to the report.
The Binance incident occurred on October 29. About $6.36 billion left the exchange’s wallets across 10 blockchains, most of it within roughly 20 minutes beginning at 20:05 UTC, TRM says. The firm attributes the theft with high confidence to TraderTraitor, which it describes as a North Korean state-sponsored unit.
Binance confirmed a security incident, suspended withdrawals on several networks and said user funds were safe. TRM reported that Binance had not disclosed the root cause and that no government had attributed the theft.
Infrastructure attacks
TRM says 88% of the value attributed to North Korea came from attacks on infrastructure, including keys, servers and transaction-signing systems. Only 13 of the 100 incidents attributed to the country were smart-contract code exploits; those accounted for about 1% of the stolen value.
As a general method, the report describes attackers approaching targets through fake recruiting or investment offers and persuading them to download coding tests that deliver malware. TRM says the malware can expose credentials and tokens that lead to systems used to authorize transactions. The report does not say this method was used in the Binance theft.
Nearly $2.7 billion frozen
By 00:30 UTC on October 30, stablecoin issuers and the Arbitrum Security Council had frozen nearly $2.7 billion of the Binance theft’s proceeds, about 42% of the total, TRM says.
The firm reports that Tether froze about $1.77 billion in USDT, Circle froze $825 million in USDC, Ripple froze $40.5 million in RLUSD, and World Liberty Financial froze $27.8 million in USD1. The Arbitrum Security Council froze about $30 million. About $48 million in RLUSD had been sold before Ripple’s freeze, according to TRM.
TRM said the attacker still held about $2.4 billion in ETH and BTC. Those native assets have no token issuer able to freeze them, the report says. The firm also reported sales of some proceeds and borrowing against stolen collateral. It said further movement through bridges, swap services and over-the-counter brokers was expected, but had not yet occurred at the time of publication.
The totals, incident attribution and freeze figures are TRM’s analysis. The firm said Binance had not published a root cause for the incident and no government had attributed it.
Information to support your research. Not personal investment, tax or legal advice. Risk & disclaimer
