North Korean hackers stole a total of $7.4 billion in cryptocurrency in 2026; during the latest large breach they withdrew $6.3 billion from Binance in 20 minutes, and the exchange froze about $3 billion. reports
Binance breach and attack methods
During the attack on Binance the perpetrators moved $6.3 billion of assets in 20 minutes. The exchange was able to freeze about $3 billion, while the whereabouts of the remaining funds remain unknown.
According to estimates, a different group the Federal Bureau of Investigation (FBI) calls TraderTraitor was involved in the most recent breach. The attackers used artificial intelligence to impersonate Binance management and trick an employee into installing malware, from which the operation began.
Who carried out earlier thefts and their scale
Estimates for previous years are based on research by Chainalysis, and data for 2026 were provided by TRM Labs. Most operations were carried out by the group known as Lazarus Group, which has been active since at least 2009.
History of thefts by year: 2017 — $29.2 million; 2018 — $522.3 million; 2022 — $1 billion 650.5 million; 2023 — $660.5 million; 2024 — $1.3 billion; 2025 — $2 billion; 2026 — $7.4 billion. According to the United Nations (UN), this is almost half of North Korea’s gross domestic product (GDP) in 2023 ($16.45 billion).
Other cyberattacks in autumn 2026
The attack on Binance was not the only major cyber operation in autumn 2026. In September–October various groups attacked government systems in Moldova and Belgium, the email of Italian prime minister Giorgia Meloni, more than 20 companies in Japan, the website of the ATB network and a Pentagon database.
These incidents are mentioned alongside the sharp rise in the volume of stolen cryptocurrency in recent years and underscore the wider range of targets chosen by hacker groups.
