On-chain analyst Darkfost puts the regime's cumulative crypto haul at nearly half its estimated 2025 economic output
North Korea’s Lazarus Group has stolen approximately $11.87 billion in crypto, according to on-chain analyst Darkfost.
That figure works out to 45% of the country’s estimated 2025 GDP, based on Bank of Korea data.
The numbers behind the heist
Darkfost’s estimate compares the group’s cumulative crypto theft against North Korea’s economic output.
Against GDP, the stolen sum equals 45%. Against Gross National Income, it equals 35%.
Darkfost is not the only one counting. Blockchain intelligence firm TRM Labs puts total North Korean crypto theft even higher, at around $12.8 billion.
TRM Labs tallies that sum across nearly 100 incidents dating back to 2017. The difference between the two estimates is about $930 million.
The more striking number is the recent pace. TRM Labs estimates that North Korean actors stole $7.4 billion in 2026 alone.
According to TRM Labs, that represents 85% of all value stolen in crypto hacks globally during the year.
One attack, twenty minutes
The largest recent incident tied to the group reportedly hit Binance on October 29 and 30, 2026.
Roughly $6.36 billion was extracted from compromised Binance wallets across ten blockchains. The draining took about 20 minutes.
The attack has been attributed to TraderTraitor, a state-sponsored unit linked to the Lazarus Group. If the figure holds, that single event would account for well over half of the year’s North Korean total on its own.
How the tally has grown
For context, Chainalysis had previously estimated that cumulative North Korean crypto theft exceeded $6.75 billion by the end of 2025.
Measured against the newer estimates of $11.87 billion from Darkfost and $12.8 billion from TRM Labs, the cumulative total appears to have nearly doubled in a short span. The 2026 activity, and the Binance incident in particular, does most of the heavy lifting in that jump.
TRM Labs’ count of nearly 100 incidents since 2017 shows a sustained campaign rather than a handful of lucky strikes. What has changed is the size of individual hits. The latest data points to a group capable of moving billions in a single coordinated operation.
What this means for exchanges, investors and regulators
The research behind these figures flags the potential for price volatility or lower transaction volumes on affected platforms as attacks come to light.
There is also a geopolitical dimension that goes beyond crypto markets. When stolen digital assets equal 45% of a sanctioned country’s GDP and 35% of its GNI, crypto theft stops looking like a sideline and starts looking like a meaningful revenue stream for the state.
That framing raises the stakes for blockchain analytics firms such as TRM Labs and Chainalysis. Their ability to trace funds across chains is increasingly part of the broader effort to limit how much of this money North Korea can actually spend.
