North Korean Hackers Took $7.61 Billion in 2026 Without Breaking Any Code
North Korean hackers stole an estimated $7.61 billion in crypto throughout 38 incidents between January and October 2026, blockchain intelligence agency BitOK says. In all six main assaults, they hijacked the individuals and programs that signal withdrawals as a substitute of exploiting code.
Freezes and seizures caught $2.86 billion, leaving $4.75 billion past attain. Binance alone accounts for $6.41 billion of the overall, whereas 32 smaller thefts towards people and companies add as much as $178.4 million.
Why Code Audits Did Not Stop North Korean Hackers
According to the BitOK report, each withdrawal in the six largest assaults carried legitimate signatures or handed commonplace checks. At Binance, the entry level was a DevOps engineer’s laptop computer and a signing-service container.
That matches earlier findings on how the hack happened in October. Elsewhere, attackers compromised multisig signers at Drift, a Solana-based buying and selling platform, a single bridge verifier at KelpDAO, and the pockets system at Bitget.
Before every heist, the operators examined the precise route with small quantities. The Binance assault contract, for instance, ran publicly 4 hours earlier than the theft.
The schedule appears to be like like workplace work. In a pattern of 540 transactions, 48% of exercise fell between 4 p.m. and 9 p.m. Pyongyang time.
The operators even took North Korean public holidays off, with no exercise recorded on these days. Saturday, Sunday, and Monday collectively accounted for simply 10% of transactions.
Once an assault began, nonetheless, the routine modified. Scripts took over, and fund actions ran across the clock.
Minutes to Swap, Days to Vanish
Speed decides what can nonetheless be frozen. Within minutes, North Korean hackers swapped stablecoins into ETH or borrowed ETH towards stolen collateral, as a result of no issuer can freeze ETH.
After the April rsETH bridge exploit, the primary 52,440 ETH left lending protocols in simply over eight minutes. The funds then sat idle for two.5 to five days earlier than scripts pushed them by way of THORChain, a cross-chain swap protocol.
Laundering turned out to be low cost. Across 2,257 Binance-linked swaps price $55.8 million, whole prices got here to simply 0.50%.
Freezes subsequently labored solely the place stablecoins had not but moved. At Binance, 43% of stolen funds have been frozen or seized, in contrast with 6% throughout all different main assaults mixed.
Even there, timing harm. Tether acquired its first freeze request 34 minutes after the Binance withdrawal. By then, 345 million USDT had already left the unique tackle.
A 0.27 ETH Slip Ties 5 Attacks Together
The clearest path got here from a cleanup error. After routing 5,047 ETH by way of Umbra, a stealth-address privateness device, and the Stargate bridge, the operator swept leftover mud into one pockets.
On August 31, 150 addresses emptied into that collector inside 3 minutes 36 seconds. The sweep linked the AFX and August 28 thefts, and Bitget addresses adopted in September. In whole, the pockets acquired solely 0.27 ETH.
Shared settlement addresses now hyperlink 5 assaults by North Korean hackers, from KelpDAO in April to Binance in October. BitOK says this factors to 1 laundering operator, though completely different groups could have carried out the hacks.
“Tiny residual balances turned the operator’s clearest path of the 12 months,” BitOK stated
Signing Keys Are the New Attack Surface
Chainalysis had already tied the Bitget theft to North Korea in October. BitOK’s information now exhibits how North Korean hackers repeat one playbook throughout exchanges and DeFi protocols.
The weak spot has shifted from good contracts to staff, gadgets, and signing providers. Issuer freezes assist solely in the primary minutes, and Binance has since covered most user losses from its personal reserves.
The publish North Korean Hackers Took $7.61 Billion in 2026 Without Breaking Any Code appeared first on BeInCrypto.