Chainalysis reports North Korea-linked hacks account for 89% of crypto theft in 2026

Suspected North Korea-linked cyber operations accounted for nearly 89% of global crypto hack losses in 2026, according to Chainalysis, up from 15% in 2021. The surge is driven by high-value attacks, including a $6.3 billion breach of Binance on October 29, 2026, and a $387 million exploit of Bitget in September 2026, both tied to the TraderTraitor group. Attackers deployed automated wallet loops, rapid conversions into Ethereum and Tron at steep discounts, and distributed 18,270 stolen Bitcoin across 19 unspent wallets.

Binance $6.3 billion hack

• ▪The Binance cryptocurrency platform suffered a major cyberattack on October 29, 2026, resulting in estimated losses between $6.3 billion and $6.4 billion
• ▪A Bitget cryptocurrency exploit in September 2026 resulted in a loss of $387 million

North Korea-linked crypto theft dominance

• ▪The average loss per suspected North Korea-linked hack increased from $50.65 million in 2021 to $185.65 million in 2026 year-to-date, according to Chainalysis
• ▪Suspected North Korea-linked hacks accounted for nearly 89% of reported cryptocurrency hack losses in 2026 through October 30, 2026, according to Chainalysis
• ▪TRM Labs estimated North Korea's share of total hack value in 2026 at approximately 85%, representing $7.4 billion stolen in 2026 year-to-date out of $12.8 billion to $13.5 billion cumulative theft since 2017
• ▪Between 2021 and October 29, 2026, total reported cryptocurrency hack losses reached an estimated $22.34 billion, with suspected DPRK-linked hacks accounting for $13.24 billion, or approximately 59%, according to Chainalysis

Novel automated laundering techniques

• ▪Chainalysis reported on October 30, 2026, that attackers in the $6.3 billion Binance hack on October 29, 2026 used automated wallet loops and dense transaction networks across hundreds of interconnected addresses to circulate stolen assets
• ▪Investigators identified a laundering pattern on the Tron blockchain where numerous wallets received exactly 1 TRX before receiving and forwarding additional funds in the $6.3 billion Binance breach on October 29, 2026

Discounted rapid asset conversion

• ▪Elliptic reported that attackers in the Binance hack on October 29, 2026 converted approximately $786 million in stolen stablecoins into Ethereum and Tron before asset freezes took effect
• ▪Attackers in the Binance breach on October 29, 2026 converted approximately 434 million USDT into 160,451 ETH on Uniswap, 1inch, and request-for-quote systems at prices 12% to 26% worse than market rates, according to Elliptic
• ▪Attackers in the Binance breach on October 29, 2026 exchanged approximately 234 million USDT for 638 million TRX on SunSwap and sold $48 million in RLUSD stablecoins alongside approximately 150 other stolen tokens, according to Elliptic

TraderTraitor group operations

• ▪The TraderTraitor cyber group, linked to North Korea, was tied by investigators to both the $6.3 billion Binance attack on October 29, 2026, and the $387 million Bitget exploit in September 2026
• ▪North Korean hacking groups relied on social engineering methods targeting humans and multi-chain laundering across multiple blockchains rather than brute-force code breaking

Bitcoin distribution across wallets

• ▪Elliptic reported that attackers divided 18,270 stolen Bitcoin from the Binance hack on October 29, 2026 across 19 addresses, holding approximately 1,000 BTC in most addresses
• ▪As of October 30, 2026, none of the 18,270 stolen Bitcoin divided across 19 addresses in the Binance hack on October 29, 2026 had reached an identified exchange or trading service, according to Elliptic