Coin

Force

Ronin

<h2 id="b-tldr-b">TLDR:</h2>
<ul>
 <li style="font-weight: 400">North Korea’s share of stolen crypto rose from 7% in 2020 to 85% so far in 2026, per TRM Labs.</li>
 <li style="font-weight: 400">Its hackers have stolen $12.8 billion in crypto since 2017, according to TRM Labs data.</li>
 <li style="font-weight: 400">At least $1.65 billion was stolen in nine months of 2025, 3.5 times its legal export earnings.</li>
 <li style="font-weight: 400">The FBI links Lazarus Group to the Ronin hack and TraderTraitor to the Bybit, DMM and Binance thefts.</li>
</ul>
North Korea crypto hacks now account for more than three of every four dollars stolen in crypto this year. Data shows the country’s share of stolen funds reached 85% so far in 2026, up from 7% in 2020. 
TRM Labs reports that its hackers have taken $12.8 billion in crypto since 2017. Eleven governments say the money supports the country’s weapons programs, while the FBI continues to link its units to major thefts.
<h2 id="b-share-of-stolen-crypto-has-climbed-each-year-b">Share of Stolen Crypto Has Climbed Each Year</h2>
TRM Labs data shows how<a href="https://blockonomi.com/binance-hack-linked-to-north-koreas-lazarus-group-as-crypto-liquidations-top-1-5-billion/" rel="noopener noreferrer nofollow"> North Korea crypto hacks</a> have grown over time. The country held 7% of stolen crypto in 2020. In 2021, its share was under 10%. It then reached 22% in 2022 and 37% in 2023. The share has risen every year in the series.
The figure rose to 39% in 2024 and 63% in 2025. So far in 2026, it stands at 85%. The year is not over, so the 2026 share may change. In total, its hackers have stolen $12.8 billion in crypto since 2017, according to TRM Labs.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" style="height: 1em; max-height: 1em;">North Korea is now blamed for more than 3 of EVERY 4 dollars hacked in crypto.
 Here's its share of all crypto stolen in hacks each year:
 2020: 7% 2021: under 10% 2022: 22% 2023: 37% 2024: 39% 2025: 63% 2026: 85% (so far)
 In total, its hackers have stolen $12.8 BILLION in… <a href="https://t.co/ktfGGjNOcH" rel="noopener noreferrer nofollow">https://t.co/ktfGGjNOcH</a>
 — Coin Bureau (@coinbureau) <a href="https://x.com/coinbureau/status/2116666537348096012?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 31, 2026</a>
 </blockquote>
</div>
Governments also reported on the 2025 thefts. Eleven governments said its hackers stole at least $1.65 billion in just nine months of that year. 
That amount is 3.5 times what North Korea earned from all legal exports that year. The comparison comes from the same group of governments.
Those governments say the money funds North Korea’s weapons programs. The FBI also blamed the country for the $1.5 billion <a href="https://parameter.io/bitget-suffers-352m-security-breach-north-korean-hackers-suspected/" rel="noopener noreferrer nofollow">Bybit hack,</a> which took place in February 2025. Separately, the US Treasury says the hackers work in units run by the country’s main spy agency.
<h2 id="b-named-units-behind-north-korea-crypto-hacks-and-earlier-attacks-b">Named Units Behind North Korea Crypto Hacks and Earlier Attacks</h2>
Several named units carry out these attacks. The FBI tied the <a href="https://moneycheck.com/zachxbt-infiltrates-chinese-crypto-laundering-ring-used-by-lazarus-group-hackers/" rel="noopener noreferrer nofollow">Lazarus Group</a> to the $620 million Ronin hack in 2022. It also uses the name TraderTraitor for the hackers behind the Bybit, DMM Bitcoin and Binance thefts.
A third group, Andariel, faces separate allegations. One alleged member has a $10 million US bounty over ransomware attacks on hospitals. 
The bounty relates to ransomware, not to crypto theft. Governments say such attacks hit US hospitals, and one Kansas medical center paid about $100,000.
North Korea’s hacking activity is not limited to crypto. Governments have blamed North Korea for the 2014 Sony Pictures attack, which knocked out thousands of computers. They also cite the 2016 theft of $81 million from Bangladesh’s central bank.
The WannaCry attack hit about 300,000 computers in 150 countries, including Britain’s NHS. A 2024 US indictment said hackers breached NASA and two US Air Force bases. 
These cases involve government networks as well as <a href="https://coincentral.com/citi-just-made-it-easier-to-invest-in-private-companies-before-they-go-public/" rel="noopener noreferrer nofollow">private companies.</a> Authorities have continued to issue sanctions and indictments against the country’s hackers. Even so, North Korea crypto hacks have not slowed.
The post <a href="https://blockonomi.com/north-korea-now-blamed-for-85-of-crypto-stolen-in-hacks-this-year/" rel="noopener noreferrer nofollow">North Korea Now Blamed for 85% of Crypto Stolen in Hacks This Year</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

North Korea Now Blamed for 85% of Crypto Stolen in Hacks This Year

Table of Contents

Blockonomi

Other articles published on Nov 1, 2026

Join our free newsletter for daily crypto updates!