North Korean hackers stole an estimated $7.61 billion in crypto across 38 incidents between January and October 2026, blockchain intelligence firm BitOK says. In all six major attacks, they hijacked the people and systems that sign withdrawals instead of exploiting code.
Freezes and seizures caught $2.86 billion, leaving $4.75 billion beyond reach. Binance alone accounts for $6.41 billion of the total, while 32 smaller thefts against individuals and firms add up to $178.4 million.
Why Code Audits Did Not Stop North Korean Hackers
According to the BitOK report, every withdrawal in the six largest attacks carried valid signatures or passed standard checks. At Binance, the entry point was a DevOps engineer’s laptop and a signing-service container.
That matches earlier findings on how the hack happened in October. Elsewhere, attackers compromised multisig signers at Drift, a Solana-based trading platform, a single bridge verifier at KelpDAO, and the wallet system at Bitget.
Before each heist, the operators tested the exact route with small amounts. The Binance attack contract, for example, ran publicly four hours before the theft.
The schedule looks like office work. In a sample of 540 transactions, 48% of activity fell between 4 p.m. and 9 p.m. Pyongyang time.
The operators even took North Korean public holidays off, with no activity recorded on those days. Saturday, Sunday, and Monday together accounted for just 10% of transactions.
Once an attack started, however, the routine changed. Scripts took over, and fund movements ran around the clock.
Minutes to Swap, Days to Vanish
Speed decides what can still be frozen. Within minutes, North Korean hackers swapped stablecoins into ETH or borrowed ETH against stolen collateral, because no issuer can freeze ETH.
After the April rsETH bridge exploit, the first 52,440 ETH left lending protocols in just over eight minutes. The funds then sat idle for 2.5 to 5 days before scripts pushed them through THORChain, a cross-chain swap protocol.
Laundering turned out to be cheap. Across 2,257 Binance-linked swaps worth $55.8 million, total costs came to just 0.50%.
Freezes therefore worked only where stablecoins had not yet moved. At Binance, 43% of stolen funds were frozen or seized, compared with 6% across all other major attacks combined.
Even there, timing hurt. Tether received its first freeze request 34 minutes after the Binance withdrawal. By then, 345 million USDT had already left the original address.
A 0.27 ETH Slip Ties 5 Attacks Together
The clearest trail came from a cleanup error. After routing 5,047 ETH through Umbra, a stealth-address privacy tool, and the Stargate bridge, the operator swept leftover dust into one wallet.
On August 31, 150 addresses emptied into that collector within 3 minutes 36 seconds. The sweep connected the AFX and August 28 thefts, and Bitget addresses followed in September. In total, the wallet received only 0.27 ETH.
Shared settlement addresses now link five attacks by North Korean hackers, from KelpDAO in April to Binance in October. BitOK says this points to one laundering operator, although different teams may have carried out the hacks.
“Tiny residual balances became the operator’s clearest trail of the year,” BitOK said
Signing Keys Are the New Attack Surface
Chainalysis had already tied the Bitget theft to North Korea in October. BitOK’s data now shows how North Korean hackers repeat one playbook across exchanges and DeFi protocols.
The weak spot has shifted from smart contracts to employees, devices, and signing services. Issuer freezes help only in the first minutes, and Binance has since covered most user losses from its own reserves.
