North Korea's Crypto Crew Netted $7.61B by Hacking People, Not Code

North Korean hackers hauled in an estimated $7.61 billion in crypto across 38 incidents between January and October 2026, according to blockchain intelligence firm BitOK. The twist: nobody cracked a line of code. In all six of the largest attacks, the crew hijacked the people and systems that sign off on withdrawals instead.

Binance was the jackpot, accounting for $6.41 billion of the total. Investigators traced the entry point to a DevOps engineer's laptop and a signing-service container. The rest of the big six followed the same pattern — compromised multisig signers at Solana-based trading platform Drift, a single bridge verifier at KelpDAO, and the wallet system at Bitget.

The thefts moved fast enough to outrun the safety net. Within minutes, the operators swapped stablecoins into ETH or borrowed ETH against stolen collateral, because no issuer can freeze ETH. After April's rsETH bridge exploit, the first 52,440 ETH left lending protocols in just over eight minutes, then sat idle for 2.5 to 5 days before scripts pushed it through cross-chain swap protocol THORChain.

Recovery numbers tell the story of that speed. Freezes and seizures caught $2.86 billion overall, leaving $4.75 billion beyond reach. At Binance, 43% of stolen funds were frozen or seized, versus just 6% across the other major attacks combined. Tether got its first freeze request 34 minutes after the Binance withdrawal — by then, 345 million USDT had already left the original address.

BitOK's report also paints an oddly mundane picture before each hit. In a 540-transaction sample, 48% of activity landed between 4 p.m. and 9 p.m. Pyongyang time, North Korean public holidays stayed quiet, and Saturday, Sunday and Monday together made up only 10% of transactions. Operators even test-drove the exact route with small amounts first — the Binance attack contract sat in public view four hours before the theft. Once a heist kicked off, though, scripts took over and the money moved around the clock.

One cleanup slip tied much of it together. After routing 5,047 ETH through stealth-address tool Umbra and the Stargate bridge, the operator swept leftover dust into a single wallet — 150 addresses emptied into it within 3 minutes 36 seconds on August 31, linking the AFX and August 28 thefts, with Bitget addresses following in September. That wallet received a grand total of 0.27 ETH. Shared settlement addresses now connect five attacks, from KelpDAO in April to Binance in October, which BitOK says points to one laundering operator even if different teams carried out the hacks. "Tiny residual balances became the operator's clearest trail of the year," the firm said. Chainalysis had already tied the Bitget theft to North Korea in October, and Binance has since covered most user losses from its own reserves.