North Korea-linked 2026 crypto theft tops $1B

TLDR

Blockchain analytics firms say North Korea-linked hackers have stolen over $1 billion in crypto in 2026, driven by a few very large exploits.

1. Chainalysis and others tie the $387 million Bitget hack plus earlier Drift and KelpDAO incidents to DPRK-linked actors, pushing 2026 theft above $1 billion.
2. These operations rely on social engineering, third-party security compromises, and cross-chain swaps through services like THORChain and privacy networks to launder stolen funds.
3. For crypto users, the concentration of losses in centralized infrastructure and bridges makes venue security, monitoring, and regulatory responses key things to watch next.

Deep Dive

1. How The $1B Number Is Reached

Chainalysis latest report on the September 24 Bitget breach attributes the roughly $387 million theft to DPRK-attributed threat actors, and says this pushes North Korea-linked 2026 crypto thefts above $1 billion, combining Bitget with earlier incidents such as Drift and KelpDAO exploited earlier in the year.Chainalysis attribution

A broader review by CertiK and Elliptic finds around $2.68 billion in total 2026 hack losses, with suspected North Korean operations responsible for more than $1 billion across about 50 incidents, meaning DPRK-linked groups account for over one third of the years total.Elliptic overview

TokenPost notes that by mid September, about $690 million in 2026 thefts had already been attributed to North Korean actors with medium or high confidence, excluding Bitget; adding Bitgets final figure is what pushes estimates over the $1 billion mark.Background on DPRK thefts

2. Attack Patterns And Laundering Tactics

The recent Bitget case highlights the shift from classic smart contract bugs to infrastructure and supply-chain compromises, with attackers abusing third-party security products and backend wallet logic rather than private keys.

Investigators traced funds across Ethereum, XRP Ledger, Zcash and Tron, and then through cross-chain liquidity protocols like THORChain to convert tens of millions of dollars of stolen XRP into Bitcoin without touching centralized exchanges.Tracing through THORChain

Earlier large incidents linked to DPRK groups, including Ronin and Harmony bridges, used similar patterns: spear-phishing, social engineering, and multi-chain routing combined with mixers and privacy coins to make freezing or recovery difficult.

3. Impact On Crypto Users And What To Watch

Because a few giant incidents at exchanges and bridges account for most of the DPRK-linked total, counterparty and infrastructure risk is now as important as protocol-level smart contract risk.

Analytics firms are accelerating tracing using AI-assisted cross-chain tools, and stablecoin issuers and some protocols are freezing identified funds, but attribution remains largely based on behavioral evidence rather than court judgments, so it is not always formally confirmed.

Regulators are tightening security and incident-reporting rules, and venues like Bitget and Bybit are expanding protection funds and monitoring, yet recovery rates still tend to be low, especially when funds pass through permissionless cross-chain liquidity.

Conclusion

North Korea-linked hacking groups have turned crypto into a significant revenue source, with 2026 thefts now estimated above $1 billion and concentrated in a handful of huge infrastructure breaches. The combination of sophisticated social engineering, supply-chain compromises, and cross-chain laundering puts a premium on venue security, transparent monitoring, and coordinated regulatory and law-enforcement responses, rather than just on individual token or protocol risk.