North Korea-linked crypto theft tops $1B

TLDR

Blockchain analytics firms say North Korea-linked hackers have now stolen more than $1 billion in crypto so far in 2026, driven largely by the Bitget exchange hack.

1. Chainalysis and Elliptic tie the recent $387.5 million Bitget breach to DPRK actors, pushing 2026 North Korea-linked thefts above $1 billion.
2. These groups increasingly target centralized infrastructure and use cross-chain bridges, THORChain, and privacy pools to launder stolen assets.
3. North Korea-linked thefts now represent a large share of global crypto hack losses, putting more pressure on exchanges, bridges, and regulators, and raising venue-risk questions for users.

Deep Dive

1. How Theft Passed $1 Billion

Chainalysis attributed the 24 Sep Bitget theft of roughly $387 million to DPRK-attributed threat actors, saying this incident pushed 2026 crypto stolen by North Korea-linked actors above $1 billion in its latest report. That assessment was summarized by The Defiant, which noted Bitgets revised loss figure of about $387.5 million after accounting for Zcash and Tron assets, and traced laundered XRP into Bitcoin through THORChain swaps.

A separate review of 2026 security incidents found about $2.68 billion in total crypto hack losses, with more than $1 billion in over 50 incidents assessed as North Korea-linked, or over 37% of the years gross-loss total, according to a CryptoSlate summary of CertiK and Elliptic data. Elliptic also estimates that since 2017, North Korea has stolen more than $6 billion in crypto overall.

These numbers rely on blockchain-analytics attribution rather than formal government designations in every case, but they align with prior confirmed attributions like the FBIs linking of the $1.5 billion Bybit hack in 2025 and the $615 million Ronin exploit in 2022 to North Korea-linked groups.

2. Tactics And Laundering Patterns

Bitgets incident illustrates current tactics. Investigators say attackers compromised third-party security tools and backend systems, then injected fraudulent withdrawal data, avoiding private-key theft while draining hot and warm wallets in 23 transfers over three hours. Chainalysis reports that tens of millions of stolen XRP were converted to Bitcoin through a cross-chain liquidity protocol, identified as THORChain, with detailed tracing of XRP-to-BTC swaps.

Decrypt reports that part of the stolen Zcash later moved into Zcashs Ironwood shielded pool, which hides sender, receiver, and amount, making onchain tracing harder. THORChain has refused Bitgets request to block attacker addresses, arguing it cannot selectively censor wallets, a stance highlighted in a Yahoo Finance piece on its role in laundering this and earlier North Korea-linked hacks.

On the laundering side, investigators like ZachXBT have observed suspected North Korea-linked launderers soliciting help in Discord and Telegram, moving funds across multiple chains and into mixers, matching patterns seen after other DPRK-attributed exploits.

3. Impact On Markets And What To Watch

Because a few very large breaches dominate annual loss totals, North Korea-linked hacks now shape overall crypto security statistics. CryptoSlates analysis shows five incidents accounted for nearly 59% of 2026s gross losses, with Bitget and Liquid Network alone making up more than a quarter.

In response, exchanges are beefing up protection funds and monitoring. Bybit, itself a prior North Korea-linked victim, says it now uses AI-assisted monitoring across 100% of business-relevant onchain activity and has intercepted over 30,000 suspicious withdrawals, while Bitget maintains a large protection fund to absorb its own loss.

Regulators are increasingly focused on cross-chain infrastructure and privacy tools that feature in these laundering flows. For users, the practical implication is that venue and infrastructure risk matter as much as coin choice: security practices, insurance or protection funds, incident response speed, and reliance on high-risk bridges or swap protocols all affect exposure if a platform is compromised.

Conclusion

North Korea-linked hacking teams have turned large, targeted crypto theft into a recurring revenue stream, with 2026s haul already above $1 billion and heavily concentrated in a few mega-breaches. The combination of centralized infrastructure attacks and sophisticated cross-chain laundering routes raises both direct loss risk and regulatory pressure on exchanges and protocols. For crypto participants, tracking how venues harden their systems and how regulators respond to these high-profile thefts will be critical to understanding where operational risk is rising or falling over the next few years.