Chainalysis: North Korea-linked actors have stolen more than $1 billion in crypto this year
October 1, 2026 (Reported October 2026, updated October 30)
Chainalysis, which published its tracing findings on October 1, attributes more than $1 billion of 2026 crypto theft to North Korea-linked actors, and Elliptic separately counts more than 51 suspected North Korean incidents that also push the total past $1 billion. The total includes the April thefts from Drift (about $285 million) and KelpDAO (about $292 million), which now fall before this six-month window, and, on the firms' assessment, Bitget (about $387 million). One report puts North Korea-linked theft in the first half at about $643 million, roughly 55% of all thefts in that period. On October 29 and 30, TRM Labs attributed the $6.36 billion theft from Binance to TraderTraitor with high confidence, and Elliptic said North Korean involvement is likely, with caveats. If that holds, North Korea-linked theft for 2026 would exceed $7 billion. The totals above do not include it, and no government has confirmed the attribution.
Why it matters
Attributions come from private analytics firms and company statements, based on on-chain patterns and timing, and are not formal government findings. The two firms count differently, so the total is an estimate.
What defenders can take from it
- Assume that staff at crypto firms are targets of long, patient social-engineering approaches.
- Verify job offers, investor meetings and support contacts through a second channel.