North Korean Hackers Crypto Theft 2026: $7.61B Stolen - Bitcoin Foundation

The report, published on November 6, details how the attackers took control of employees, signing devices, and withdrawal systems rather than breaking smart-contract code. This approach allowed them to produce transactions that passed ordinary checks, making the thefts harder to detect at the protocol level.

Attack Methods

In the six largest incidents, attackers compromised systems at the point where assets leave platforms. At Binance, they targeted a DevOps engineer's laptop and a signing-service container. Similarly, they compromised multisig signers at Drift, a bridge verifier at KelpDAO, and wallet systems at Bitget.

The resulting transfers carried valid signatures or passed standard checks. A transaction can look authorized at the protocol level even when the person or device approving it has been compromised.

Recovery Efforts

Freezes and seizures captured $2.86 billion of the stolen funds, leaving $4.75 billion beyond reach. Binance alone accounts for $6.41 billion of the reported total, while 32 smaller thefts added up to $178.4 million. Recovery worked best when stolen assets stayed in stablecoins or at services able to block transfers.

Attribution Challenges

BitOK linked the incidents through common laundering patterns, particularly across five attacks from KelpDAO in April to Binance in October. The shared settlement addresses point to one laundering operator, though different teams may have conducted the hacks themselves. Chainalysis had previously tied the Bitget theft to North Korea in October.

What Happens Next

The findings highlight growing security challenges in crypto platforms, particularly around access controls for transaction approval systems. Industry experts expect increased focus on securing signing mechanisms and multi-layer verification processes to prevent similar attacks in the future.