North Korean crypto thefts top $1B

TLDR

New blockchain analysis finds North Korea-linked groups have stolen over $1 billion in cryptocurrency this year, highlighting how central crypto hacks have become to Pyongyangs funding.

1. Chainalysis ties the $387 million Bitget hack to North Korean actors, lifting cumulative DPRK-linked crypto thefts in 2026 above $1 billion.
2. These operations use social engineering and cross-chain laundering across Ethereum, XRP, Zcash and Tron, with 2025 crypto losses already exceeding $2 billion.
3. For users and exchanges, the trend raises counterparty and bridge risk, while regulators and firms respond with tracing tools, freezes and sanctions that still cannot reliably recover funds.

Deep Dive

1. Chainalysis New $1B Estimate

Blockchain analytics firm Chainalysis attributed Bitgets September 24 hot- and warm-wallet breach, worth about $387 million, to North Korea-linked actors, stating that this pushed 2026 DPRK-attributed crypto thefts above $1 billion in value.Bitget hack to North Korean actors

In the first three hours, attackers moved the funds in 23 transfers across Ethereum, XRP, Zcash and Tron, then through cross-chain liquidity protocols, instant swaps and other services to reach attacker-controlled Bitcoin addresses, which investigators now monitor.Chainalysis tracing of stolen funds

Chainalysis also noted that DPRK actors stole over $2 billion from the crypto industry in 2025, so the new $1 billion-plus 2026 figure reflects a sustained multi-year campaign rather than an isolated spike.2025 losses already exceeding $2 billion

2. Tactics: From Social Engineering To Cross-Chain Laundering

Recent cases show North Korean groups combining traditional social engineering with modern DeFi and bridge exploits. Drift Protocol reportedly lost $285 million after months of social engineering that culminated in an April attack, while a KelpDAO bridge exploit in April took another $292 million linked to Lazarus-affiliated operators.April exploits tied to DPRK groups

The Bitget case demonstrates their cross-chain laundering playbook: funds spread across multiple chains, use of Zcashs privacy features, routing XRP through a cross-chain liquidity protocol to obtain Bitcoin, and continued movement through services like THORChain that resist address-level freezes.Cross-chain laundering across multiple networks

To keep up, Chainalysis built in-house AI automations that cut more than 20 hours of manual bridge reconciliation into under 10 minutes, with human investigators directing the logic and reviewing results.AI-assisted tracing of bridge flows

3. Risks For Crypto Users And What To Watch

For users, the direct thefts usually hit exchanges and protocols rather than individual wallets, but the knock-on risks are real: withdrawal pauses, reputational damage, and potential insolvency if platforms lack large protection funds. Bitget, for example, relied on a protection fund above $300 million and a high reserve ratio to reassure customers after its breach.Bitgets post-hack protection measures

Stablecoin issuers and platforms can sometimes freeze small portions of stolen funds, but most value is laundered across privacy tools and bridges, limiting recovery. Meanwhile, regulators add sanctions lists and enforcement targeting DPRK-linked wallets, which can tighten compliance burdens for exchanges and stablecoin projects.

Conclusion

North Korea-linked crypto thefts surpassing $1 billion in 2026 reflect a mature, ongoing campaign that taps exchanges, DeFi and bridges as funding channels.

Even as analytics firms and issuers improve tracing and freezing capabilities, most stolen funds remain unrecovered, so the practical defense is stronger platform security and more cautious reliance on cross-chain infrastructure.

Watching major exchange security reports, bridge audits and sanctions developments can help crypto users gauge when systemic risk from state-linked hacking is rising or easing.