North Korea’s $7.61B Crypto Heist: The 2026 Cybercrime Chronicles

According to blockchain analytics company BitOK, North Korean cybercriminals have pilfered around $7.61 billion across 38 distinct incidents from January to October 2026. The report, published on November 6, also highlighted $2.86 billion in funds that were recovered through freezing and seizure actions.

The report indicates a change in the methods used in these attacks. In the six most significant incidents, the hackers did not need to manipulate the smart contract code. Instead, they gained access to employees’ tools, signing devices, and withdrawal systems—the infrastructure that allows transactions to bypass standard auditing processes.

Overview of North Korean Cybercrimes in 2026

Breaking Down BitOK’s 2026 Estimates

BitOK identified 38 theft incidents attributed to North Korean hackers from January to October of 2026. This figure encompasses thefts from exchanges, DeFi platforms, and other cryptocurrency enterprises, with the six major incidents accounting for the bulk of the total losses.

These figures reflect assets taken, rather than a single heist or event. The report links these events through similar laundering techniques, but it remains unclear if different groups executed each individual breach.

Amount of Crypto Recovered

Crackdowns and freezes resulted in the recovery of $2.86 billion, leaving another $4.75 billion unrecovered, as per BitOK’s analysis. Recovery efforts were most successful when stolen funds remained in stablecoins or at platforms capable of halting transfers.

Notably, Binance alone held accounts for $6.41 billion of the reported figures. BitOK also indicated 32 smaller thefts totaling $178.4 million. These smaller figures do not align with the overall $7.61 billion estimate and should be treated as separate entities in the report.

Identifying Those Behind the Attacks

Why Attribute These Incidents to North Korea?

The cyber operations have been attributed to North Korean hackers. Chainalysis had previously linked the Bitget theft to North Korea in October, marking an earlier identification within this broader context.

This attribution pertains to suspected connections and techniques rather than naming any individuals who have been charged or convicted regarding these events in 2026.

Connections Among Five Distinct Attacks

BitOK uncovered common settlement addresses linked to five thefts, ranging from the KelpDAO breach in April to the Binance hack in October. These addresses were utilized during the transfer and laundering of stolen assets, providing investigators a uniform trail amid otherwise distinct incidents.

According to the report, this tracker suggests a single laundering operator, although different groups may have actually carried out the intrusions, leaving the exact relationship between the invaders and laundering operation ambiguous.

Background: Accessing Signing Systems

Binance’s Vulnerability Point

For Binance, the entry point was identified as a DevOps engineer’s laptop in conjunction with a signing-service container, as per BitOK’s findings. The attackers utilized these systems to approve withdrawals instead of exploiting any flaws within the blockchain itself.

This distinction is critical. The resulting transactions bore valid signatures or were able to navigate standard protocols. A transaction may appear to be authorized from a protocol standpoint even if the individual or device granting approval has been compromised.

Other Systems Targeted

This broad strategy was also evident in other significant incidents. Attackers managed to infiltrate multisignature signers at Drift, compromise a single bridge verifier at KelpDAO, and take over Bitget’s wallet system.

These components are crucial just before funds exit a platform. By gaining control over a signer, verifier, or wallet process, unauthorized withdrawals that seem legitimate can be executed without altering the chain’s underlying code.

Preparations Made by Hackers

Prior to each theft, the cybercriminals tested their method using small amounts. The contract used in the Binance attack was publicly active four hours before the primary theft, allowing the attackers to establish confidence in their intended execution path.

The timing also unveiled a consistent operational pattern. In an analysis of 540 transactions, nearly half occurred between 4 p.m. and 9 p.m. Pyongyang time, with weekends generating only 10% of the activity in that analysis.

Importance of the Findings: Risks of Freezes

Why did Attackers Transition Assets into ETH?

Within minutes of executing an attack, the perpetrators exchanged stablecoins for ETH▼$2,223.73 or leveraged ETH against the stolen collateral. This tactic diminished the effectiveness of issuer-level freezes since no token issuer has the capability to halt ETH transactions.

The rapid pace of these conversions minimized the opportunity for exchanges, issuers, and investigators to act. As funds traversed additional services and blockchains, tracking and recovery became increasingly complex.

How Quickly Did Funds Disperse After the rsETH Bridge Exploit?

Following the rsETH bridge exploit in April, an initial 52,440 ETH was extracted from lending protocols in just over eight minutes. These funds then remained inactive for 2.5 to 5 days before moving through THORChain, a cross-chain swapping platform.

This delay did not necessarily enhance the recoverability of the assets. Instead, it provided the operators enough time to exit the lending platforms before initiating another laundering sequence.

When Was the First Freeze Request Submitted for Binance?

Tether reacted to its first freeze request 34 minutes post-Binance withdrawal. By that time, 345 million USDT▲$0.9991 had already vacated the original address.

Binance managed to achieve a higher rate of recovery compared to other significant breaches discussed in BitOK’s study, but the initial few minutes determined what interventions could be made. According to reports, Binance has since compensated most user losses from its reserves.

Key Figures: Recovery Efforts and Laundering Expenses

Comparative Performance of Binance Against Other Major Attacks

As per BitOK’s findings, 43% of the assets taken during the Binance incident were either frozen or seized, while the corresponding figure for other major breaches was a mere 6% cumulatively.

Quick responses and stablecoins contributed to these results. Assets that remained with a provider or platform could be stifled, while ETH and similar assets that shifted beyond an issuer’s direct control were significantly harder to reclaim.

What Were the Laundering Costs?

The cost across 2,257 Binance-associated swaps amounts to roughly 0.50%. At that ratio, the operators could transfer significant sums without incurring substantial fees as an obstacle.

The swaps fed into a broader laundering operation, which involved cross-chain transfers, lending systems, and privacy measures. Not every asset needed immediate movement, allowing for the rest of the process to be automated once the initial withdrawal was successful.

Operating Trends Observed by BitOK

Transaction patterns indicated heightened activity concentrated in a five-hour window aligned with Pyongyang time, while weekends and Mondays demonstrated comparatively low activity. Public holidays showed no recorded transactions in the sample analyzed.

Once an attack commenced, the situation flipped dramatically. Automated scripts kept funds circulating round the clock, maintaining laundering operations long after the initial breach was concluded.

Dust Trails and the 0.27 ETH Connection

What Transpired on August 31?

After routing 5,047 ETH through Umbra, a stealth-address privacy tool, and the Stargate bridge, leftover balances were consolidated into a collector wallet. On August 31, 150 addresses were drained into this collector in just 3 minutes and 36 seconds.

The collector ultimately received a mere 0.27 ETH. While insignificant compared to the total stolen funds, the repetitive minimal balances helped to establish a connection between addresses linked to various incidents.

Which Incidents Did This Trail Associate?

BitOK indicated that this transfer associated the AFX theft with the incident on August 28, while also connecting Bitget-related addresses in September. Shared settlement addresses then bridged five thefts, including KelpDAO in April and Binance in October.

In terms of attribution, these minor transactions proved to be more beneficial than larger amounts routed through exchanges and bridges. Operational errors can persist even when principal funds are dispersed across multiple platforms.

Attribution Risks and Open Questions

Can a Shared Laundering Address Indicate a Single Hacking Team?

No. BitOK’s analysis points to one laundering operator, yet the same report allows for the existence of multiple teams executing the various hacks. The common addresses serve to connect segments of the funds’ movement without attributing every breach to a single group.

This distinction is crucial when evaluating incidents involving Binance, Drift, KelpDAO, Bitget, and others. Similar tactics might suggest shared expertise, replicated strategies, or a communal laundering service rather than the effort of one operational entity.

What Makes Signing Systems a Significant Risk Today?

The report’s primary security revelation emphasizes that vulnerabilities have shifted from smart contracts to employees, devices, and signing services. No code audit can detect an infiltrated laptop or a compromised withdrawal approval system.

Businesses managing multisig wallets, bridge verifiers, and automated signing containers now face a security challenge that extends beyond just the code utilized on the chain. An attacker with legitimate access can execute an unauthorized transfer that appears routine.

Future Implications for Crypto Security

Which Security Measures Does BitOK Suggest?

According to BitOK’s findings, signing keys—and the individuals or systems managing them—should be at the center of future security initiatives. Exchanges and DeFi platforms need to supervise the devices, containers, and approval pathways that precede a transaction’s entry into the blockchain.

Even small remaining balances warrant close monitoring. The collector that received 0.27 ETH held none of the essential proceeds, yet it linked addresses involved in five separate thefts.

Insights for Platforms from Recovery Metrics

Quick detection and prompt issuer action yield substantial benefits. Binance recovered or froze 43% of the stolen funds during its incident, compared to a mere 6% across other significant breaches.

This contrast underlines a practical priority: identify unusual withdrawal patterns swiftly, file freeze requests without hesitation, and trace the initial swaps following a compromised signer. Once stablecoins transition to ETH or navigate through cross-chain platforms, recovery prospects diminish.

Users should remain vigilant as well. Just because a transaction appears valid does not guarantee the security of the withdrawal process—it could have passed all technical checks while being under the control of an attacker.