Chainalysis ties 89% of 2026 crypto hack losses to North Korea

Suspected North Korea-linked hackers were behind nearly 89% of reported crypto hack losses in 2026, blockchain intelligence firm Chainalysis said in figures released on October 30. One record theft, the $6.4 billion Binance breach, accounts for most of that share.

The data runs through October 29. It comes from Chainalysis, one of the firms that trace stolen coins across public blockchains. In a separate post the same week, the company tied the Binance theft to a group it calls TraderTraitor.

What the figures show

Chainalysis put the 2026 share of hack losses linked to suspected North Korean actors at nearly 89 percent. Back in 2021 the figure was 15 percent. The average loss per suspected North Korea-linked attack has climbed to $185.65 million this year, from $50.65 million in 2021. That is about 3.7 times higher.

Over the longer run the pattern holds. From 2021 through October 29, 2026, reported crypto hack losses total $22.34 billion, Chainalysis said. It attributes $13.24 billion of that, around 59 percent, to suspected North Korea-linked operations.

Kwon Jun-hyuk, who heads Chainalysis Korea, said the country's crypto hacking keeps growing in scale and has become a serious security problem across the industry. North Korea denies it. Pyongyang has called earlier accusations politically motivated.

A climb that predates the Binance hack

This climb did not start in 2026. TRM Labs, a separate blockchain intelligence firm, put North Korea's share of hack losses below 10 percent in 2021, then at 22 percent in 2022, 37 percent in 2023, 39 percent in 2024 and 64 percent in 2025. Two firms, two methods, one direction. TRM also estimates the country has taken more than $6 billion since 2017.

Long before October, 2026 was already a heavy year. In April the Drift Protocol lost about $285 million, and KelpDAO about $292 million just over two weeks later. In September roughly $387 million went missing at the Bitget exchange. Security firms Elliptic and TRM Labs tied each of those thefts to TraderTraitor. Then came Binance.

One breach is doing most of the work

Here is what the headline number hides. The 2026 share rests on a single event. On October 29, 2026, Binance disclosed a breach it estimated at about $6.3 billion. Chainalysis counted roughly $6.4 billion in unauthorized transfers across several blockchains, and said the money began moving at around 4:20 p.m. Eastern time. Take that one theft out, and the yearly picture changes a lot.

Chainalysis linked the breach to TraderTraitor by following the coins. Money from the Binance theft mixed on-chain with money from the earlier Bitget hack, which had already been tied to North Korean actors. That overlap was the key. Chainalysis also tracks TraderTraitor as part of the wider Lazarus Group.

Bitcoin traded at $77,797 at 07:45 UTC on November 1, according to CoinGecko, as the market worked through the loss. The breach has already pushed at least one bitcoin treasury company to clear a large sale.

By October 30, stablecoin issuers, law enforcement and other firms had frozen about $2.8 billion of the stolen funds, Chainalysis said. Recovery is slow. How much comes back is not yet known, and the company expects the coins to keep moving.

That freeze cuts both ways. The fact that stablecoin issuers can lock up billions at short notice is what makes recovery possible at all. It is also a reminder for ordinary holders that the same tokens can be frozen by the companies that issue them. Decentralization has limits when the money needs to be stopped.

How the thefts begin

These thefts rarely start with clever code. They start with people. TRM Labs and Elliptic have traced the year's largest losses to months of patient groundwork rather than a single flaw. In the Drift case, TRM says the preparation began weeks before any money moved.

Security researchers at Cisco Talos have documented campaigns that slip North Korean workers into crypto firms through fake job offers, posing as outside contractors for months. Others use cloned voices and deepfake video during hiring calls. Once trusted, an insider does not need to break anything. That shifts the defense from better code to better hiring.

A second firm, a similar call, different math

Chainalysis is not alone in the attribution. TRM Labs also tied the Binance theft to TraderTraitor and put the transfers at about $6.36 billion. The FBI reached the same conclusion on who was behind it.

The dollar figures do not match exactly. Binance estimated $6.3 billion. Chainalysis counted about $6.4 billion. TRM Labs landed on $6.36 billion. Each firm measures on-chain value its own way, and at slightly different moments, which is why one hack can carry three price tags. None of the figures are final.

What to watch

Two things decide whether the 89 percent figure means what it seems to. First is recovery. A freeze is not a refund, and earlier cases show how slow and partial the return of stolen crypto can be.

Second is the rest of the year. One more large theft, from any group, would pull the share down fast, because the 2026 total rests on so few big events. A quieter close to the year would push it the other way. The number will not settle until the counting stops.

A third is whether exchanges and protocols change how they hire. If the money keeps walking in the front door, carried by fake staff rather than let through by broken code, then audits and bug bounties will not stop it. Vetting a contractor is a slower fix than patching a contract, and a harder one to measure. Few firms will say in public how exposed they are.