North Korea’s Crypto Theft Tally Hits $12.8B, TRM Labs Says
TRM Labs estimates North Korea-linked hackers stole $7.4 billion through October 29, accounting for 85% of 2026 crypto hack losses by value.
Key Notes
- TRM estimates North Korea-linked crypto theft at $12.8 billion since 2017.
- The 85% figure measures 2026 hack losses by value through October 29, not incident count.
- The tally includes the Binance theft and a tentative attribution of the Bitget attack.
North Korea-linked hackers have stolen an estimated $12.8 billion in cryptocurrency across 100 incidents since 2017, according to a TRM Labs report. Some $7.4 billion was taken in 2026 through October 29, dominated by the Binance attack.
The researchers put North Korea’s share at 85% of worldwide crypto hacking losses by value this year. That measures dollars stolen, rather than the number of attacks.
Binance Drives the Record Total
TRM’s Binance investigation estimates that $6.36 billion left exchange wallets across ten blockchains on October 29, with most transfers concentrated in about 20 minutes. It attributes the theft to North Korea-linked TraderTraitor with high confidence. CoinScreamer’s attribution report explains the evidence and its limits.
Excluding Binance, North Korea’s share of 2026 losses falls to 45%. The tally also includes Bitget, whose attribution remains tentative: TRM says another actor is still technically possible. The figures are research estimates with a stated cutoff, rather than final full-year totals.
People Provide Access to Signing Systems
The report describes fake recruiters and coding tests delivering malware that steals SSH keys, session cookies and cloud tokens. Access to employees’ systems can then expose transaction-signing infrastructure. Infrastructure attacks account for 88% of the value TRM attributes to North Korea, including Binance.
On Ethereum, TRM identified 50 prepared EIP-7702 authorizations that let attacker-controlled code run through a Binance wallet. Other chains saw ordinary signed transfers. TRM’s assessment points to compromised signing infrastructure; valid signatures alone do not establish that private keys were extracted.
Our Binance explainer separates that signing authority from a failure of the blockchain itself. The broader lesson is that protecting keys also requires protecting the people, devices and approval systems allowed to use them.
Frozen Funds Remain a Separate Measure
TRM’s early Binance snapshot, taken at 00:30 UTC on October 30, counted roughly $2.7 billion frozen, including about 1.77 billion USDT and 825 million USDC. Those dated balances should not be read as a current recovery total.
A freeze restricts assets; it does not automatically return them. Native Bitcoin and ETH have no stablecoin issuer that can blacklist them, although investigators and exchanges can still trace transfers, screen deposits and pursue seizure where they obtain control.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
