North Korea crypto hacks now 85-89% of 2026 losses after $6.4B Binance theft

30 Oct 2026

30 Oct 2026, 22:41 UTC+01:00

Exchanges TradeReviewed News Desk

North Korea crypto hacks now account for the overwhelming majority of money stolen from the industry this year. Suspected North Korea-linked attacks make up nearly 89% of reported crypto hack losses in 2026, up from 15% in 2021, according to Chainalysis data shared by Cointelegraph on Friday, October 30, 2026. A separate report from TRM Labs, published the same day, puts North Korea’s 2026 share at 85% of all hacked value.

The jump is driven mostly by one event: the Binance hot wallet theft of October 29, which Chainalysis sizes at about $6.4 billion and TRM at about $6.36 billion, the largest theft in crypto history.

What the data shows

According to TRM Labs, North Korea-backed hackers have stolen about $12.8 billion in crypto across 100 incidents since 2017, and $7.4 billion of that in 2026 alone. Total crypto hack losses in 2026 year to date reached about $8.7 billion, the highest on record. TRM says North Korea’s share was 63% in 2025, 39% in 2024 and 7% in 2020. Excluding Binance, the 2026 share drops to 45%.

Both firms attribute the Binance theft to TraderTraitor, a North Korean cybercrime group. Chainalysis says the strongest evidence came when it saw funds stolen from Binance commingle on-chain with proceeds of last month’s Bitget exploit, which had been linked to North Korea. TRM notes that Binance has not published a root cause and that no government has formally attributed the theft.

Infrastructure, not smart contract bugs

TRM’s breakdown shows how North Korea operates differently from typical hackers. Only 13 of its 100 attributed incidents were code exploits, worth about 1% of what it stole. Including Binance, 88% of its stolen value came from infrastructure attacks on keys, servers and signing systems, often reached through fake recruiters, malware-laced coding tests and stolen credentials. At Binance, TRM says the attacker used 50 pre-signed authorizations on Ethereum and recommends that exchanges monitor EIP-7702 delegations.

Freezes have limited the damage. TRM counted nearly $2.7 billion frozen by about 00:30 UTC on October 30, including about 1.77 billion USDT by Tether and 825 million USDC by Circle. The attacker still holds more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, which no issuer can freeze. For the broader policy fallout, read our report on Trump and the CFTC reacting to the Binance hack.

What it means for traders

• About $2.4 billion in unfrozen ETH and BTC is still in the attacker’s hands. Large moves of those coins to bridges, swap services or OTC desks could add selling pressure and headline volatility.
• The lesson from the data is custody risk at the platform level. Spreading funds across venues and keeping long-term holdings in self-custody reduces exposure to any single exchange.
• Compare security track records and fees in our crypto exchange comparison, read our BingX review (number 1) and OKX review (number 2), and see how we test exchanges. New to crypto? Start with where to buy your first Bitcoin.

This is not financial advice.

Sources

• Cointelegraph on X: North Korea-linked hacks nearly 89% of 2026 losses (Chainalysis)
• TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026
• Chainalysis: The $6.4 Billion Binance Hack, Tracing the North Korea Link

Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.

Related reviews

• Bingx review
• Okx review

Sources

• Cointelegraph: North Korea-linked hacks account for nearly 89% of 2026 crypto hack losses (Chainalysis)
• TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026
• Chainalysis: The $6.4 Billion Binance Hack: Tracing the North Korea Link

News is for information only and is not financial advice. More crypto news