North Korean hackers are responsible for the majority of stolen cryptocurrencies in 2026, according to data released by blockchain intelligence firm TRM Labs. The country’s share of stolen digital assets has surged to 85% so far this year, a significant increase from just 7% in 2020.
Rising share of crypto thefts
TRM Labs, a US-based blockchain analytics company, stated that North Korean hacking groups have targeted exchanges, bridges, and other crypto-related businesses with increasingly sophisticated attacks. Their activity has grown rapidly over recent years, both in overall value and proportion of global crypto thefts.
Historical data indicates that North Korea’s share of global crypto theft was under 10% in 2021, climbed to 22% in 2022, and grew further to 37% by 2023. The trend continued with 39% in 2024 and 63% in 2025. The current share for 2026 stands at 85%, reflecting an accelerating pattern.
In total, North Korean hackers have stolen $12.8 billion in cryptocurrencies since 2017, according to figures compiled by TRM Labs.
Eleven governments jointly estimated that in just the first nine months of 2025, hackers linked to North Korea stole at least $1.65 billion worth of crypto assets. Officials emphasized that this amount is 3.5 times higher than the value of all of North Korea’s legal exports in the same period.
| Year | North Korea’s Share of Stolen Crypto |
|---|---|
| 2020 | 7% |
| 2021 | Under 10% |
| 2022 | 22% |
| 2023 | 37% |
| 2024 | 39% |
| 2025 | 63% |
| 2026 (so far) | 85% |
Identifying the hacking groups
US authorities have attributed major hacks to specific North Korean government-linked units. The FBI has tied the group known as Lazarus Group to the $620 million Ronin Network hack in 2022. The same agency refers to the hackers behind attacks on Bybit, DMM Bitcoin, and Binance as TraderTraitor.
Another group, Andariel, has faced allegations connected to ransomware activity targeting health care providers in the United States. The US government has offered a $10 million bounty for information on one alleged member of Andariel, related to ransomware rather than crypto-related thefts.
The US Treasury reported that many of these hackers operate under the Reconnaissance General Bureau, North Korea’s main intelligence agency.
Mini dictionary: Lazarus Group — An alleged North Korean state-sponsored cybercrime group accused of carrying out some of the world’s largest cryptocurrency thefts and various cyber-espionage operations for the regime.
Governments claim that proceeds from these cyberattacks are used to fund North Korea’s missile and weapons development programs.
Broader cyber operations
North Korean cyber activity is not limited to the crypto sector. Authorities have linked the country to high-profile incidents such as the 2014 attack on Sony Pictures and the 2016 $81 million theft from Bangladesh’s central bank. The WannaCry ransomware attack in 2017, which compromised around 300,000 computers across 150 countries, including the UK’s National Health Service, is also attributed to North Korean actors.
A 2024 US indictment detailed further breaches involving the hacking of NASA and two US Air Force bases, highlighting the broad scope of activity attributed to North Korean-linked groups.
Despite ongoing sanctions and indictments by various governments, experts have not observed a significant decline in the scale or frequency of North Korea’s crypto-related cyberattacks.
Authorities worldwide continue to warn about the growing threat of state-sponsored hacking targeting the digital assets sector, stating that the vast sums stolen by North Korea far exceed its legitimate export earnings.
