North Korea-linked hackers are behind 89% of global crypto theft losses this year, Chainalysis says

Chainalysis says North Korea-linked hacking entities are now presumed to account for about 89% of global cryptocurrency hacking losses reported this year. For exchanges, PSPs, and banks touching crypto flows, the useful part is not the geopolitics; it is the scale and the pattern of theft, laundering, and fund recycling that now sits behind a growing share of incident volume.

1. Chainalysis said North Korea was behind the hacking incident in which about $6.3 billion worth of cryptocurrency was stolen from Binance Holdings Ltd., the world's largest cryptocurrency exchange. The firm identified North Korea's elite hacking unit TraderTraitor as the group behind the attack, which it described as the largest cryptocurrency theft ever recorded.
2. According to Chainalysis, the share of total cryptocurrency hacking losses presumed to be linked to North Korea rose from 15% in 2021 to 89% this year, nearly a sixfold increase over five years. That is the kind of concentration that matters for anyone underwriting crypto exposure: one state-linked actor now dominates the loss profile.
3. The average loss per suspected North Korea-linked hacking case increased from $50.65 million in 2021 to $185.65 million this year, about 3.7 times higher. In practice, that means fewer incidents, larger tickets, and a much heavier operational burden when a breach hits an exchange, DeFi protocol, or investor wallet set.
4. Chainalysis said it found indications on the blockchain that funds taken from Binance Holdings Ltd. had mixed with funds stolen from Bitget last month, and used that as the basis to presume North Korea's involvement. Mixing stolen funds across incidents is the sort of on-chain pattern compliance teams, investigators, and liquidity providers watch for because it complicates tracing and recovery.
5. From 2021 to Oct. 29, 2026, total cryptocurrency hacking losses reached $22.34 billion, of which $13.24 billion are suspected to be linked to North Korea, or 59% of the total. Chainalysis also said North Korea-linked hackers have increasingly used automated methods with artificial intelligence (AI), which has raised the number of attacks and accelerated asset theft.