Suspected DPRK operations now drive the overwhelming majority of stolen crypto, with average losses per attack more than tripling since 2021
Crypto has a hacking problem. Increasingly, that problem traces back to Pyongyang.
Suspected North Korea-linked hacks accounted for nearly 89% of reported crypto hack losses in 2026 so far, according to data published by blockchain analytics firm Chainalysis on October 30, 2026. In 2021, that share was just 15%.
The numbers behind the surge
Chainalysis tracked reported crypto hack losses from 2021 through October 29, 2026. Over that window, total reported losses came to an estimated $22.34 billion.
Suspected DPRK-linked hacks made up an estimated $13.24 billion of that total. That works out to about 59% of all reported losses across the period.
The more telling figure may be the size of each attack. The average loss per suspected DPRK-linked incident was $50.65 million in 2021, per Chainalysis.
In 2026 year-to-date, that average climbed to $185.65 million. Each attack is now more than three times as costly as it was five years ago.
The data points to fewer, bigger strikes rather than a flood of small ones. The concentration of losses in a handful of major events, rather than a broad rise in hacking volume, suggests a deliberate focus on high-value targets.
The big hits of 2026
Two incidents loom over the year’s totals. The largest is a Binance hack on October 29, 2026, with losses estimated at roughly $6.3 billion to $6.4 billion.
Earlier, in September 2026, a Bitget exploit resulted in a loss of $387 million. Both incidents have been linked to TraderTraitor, a North Korean cyber group tied to a string of high-value attacks.
The techniques involved are not brute-force code breaking. The attacks have relied on sophisticated methods such as social engineering, which targets people rather than software, and multi-chain laundering, which moves stolen funds across several blockchains to obscure the trail.
A second opinion from TRM Labs
Chainalysis is not the only firm tracking this. Rival analytics company TRM Labs estimates North Korea’s share of total hack value in 2026 at around 85%.
TRM Labs puts the regime’s cumulative crypto theft since 2017 at approximately $12.8 billion to $13.5 billion. It estimates $7.4 billion of that was stolen in 2026 year-to-date alone.
The two firms use different methods and time windows, so their figures do not line up perfectly. The direction, however, is the same. Both show North Korea-linked activity dominating crypto theft this year.
How we got here
Back in 2021, North Korea-linked hacks were one threat among many. Chainalysis data puts their share of losses that year at 15%, meaning most stolen crypto went to other attackers.
Groups like TraderTraitor have become repeat names in breach reports. The pattern has been consistent: target large platforms, exploit human access points, then launder proceeds across multiple networks.
