North Korea's Lazarus Group has swiped $11.87B in crypto, 45% of its GDP

North Korea's crypto theft machine just posted numbers that read like a country's balance sheet. On-chain analyst Darkfost estimates the Lazarus Group has now swiped roughly $11.87 billion in digital assets, a haul worth about 45% of the regime's estimated 2025 GDP, per Bank of Korea data. Measured against Gross National Income instead, the stolen crypto equals 35%. Either way, crypto theft is no longer a side hustle for Pyongyang.

TRM Labs counts even more. The blockchain intelligence firm puts total North Korean crypto theft at around $12.8 billion spread across nearly 100 incidents going back to 2017 — roughly $930 million above Darkfost's tally. That gap is small change next to the bigger story: the pace. TRM Labs estimates North Korean actors pulled in $7.4 billion in 2026 alone, which it says accounts for 85% of all value stolen in crypto hacks worldwide that year.

One event does most of the lifting. According to TRM Labs, the largest recent hit tied to the group struck Binance on October 29 and 30, 2026, draining roughly $6.36 billion from compromised wallets across ten blockchains in about 20 minutes. The attack has been attributed to TraderTraitor, a state-sponsored unit linked to Lazarus. If that figure holds, a single 20-minute window would account for well over half of the year's North Korean total.

The jump is stark compared with earlier tracking. Chainalysis had previously estimated cumulative North Korean crypto theft exceeded $6.75 billion by the end of 2025. Stack that against the newer $11.87 billion and $12.8 billion figures, and the total appears to have nearly doubled in a short stretch — with 2026 activity and the Binance incident doing the heavy lifting.

Nearly 100 incidents since 2017 point to a sustained campaign rather than a few lucky strikes. What has shifted is the size of the individual hits: the latest data shows a group capable of moving billions in one coordinated operation. The research behind these numbers also flags potential price volatility or thinner transaction volumes on affected platforms as attacks surface.

Then there's the geopolitical math. When stolen digital assets equal 45% of a sanctioned country's GDP and 35% of its GNI, tracing becomes a national security tool, not just a market one. That raises the stakes for analytics firms like TRM Labs and Chainalysis, whose cross-chain tracking is now part of the effort to limit how much of this money North Korea can actually spend.