Across 12 North Korea-linked crypto theft cases, approximate
From 2022 to 2026, 12 crypto theft incidents involving North Korea-backed hackers or suspected related cases totaled about $9.74 billion, of which Binance accounted for about $6.3 billion, or 65%. Bybit, Ronin/Axie Infinity, Bitget, etc. are also on the list. Amounts are converted based on valuations at the time of the incidents, and only some major cases are included.
Event Timeline
- [11-03 06:38] The total stolen amount in 12 North Korea hacker-linked crypto theft cases was about $9.74 billion, with Binance accounting for 65% (PANews)
- [11-03 06:40] The amount involved was about $9.74 billion, with Binance accounting for 65% of North Korea-linked crypto theft cases (Odaily Planet Daily)
Background and Impact
On November 3, 2026, PANews and Odaily Planet Daily successively reported that from 2022 to 2026, 12 crypto theft incidents involving North Korea-backed hackers or suspected related cases totaled about $9.74 billion. PANews said the information came from a Gelonghui report and cited materials such as TRM Labs, FBI notices, and exchange announcements.
In terms of amount distribution, Binance had the largest stolen amount, about $6.3 billion, accounting for 65% of the total for the listed cases. Other major cases include: Bybit with $1.5 billion stolen, Ronin/Axie Infinity with $620 million stolen, Bitget with $388 million stolen, DMM Bitcoin with $308 million stolen, and WazirX with $235 million stolen; in addition, Harmony Horizon and Atomic Wallet each had $100 million stolen.
In terms of attribution and statistical methodology, Binance, Bybit, and DMM Bitcoin were directly named by the U.S. government as acts by TraderTraitor, while most of the other eight were classified under the Lazarus system. The reports also make clear that the above amounts are converted based on valuations at the time of the incidents, and only some major cases are included; they are not a loss tally for all related cases. The two sources are consistent in their statements on the total, share, and amounts of each case, with no numerical conflict observed; however, because both are compiled from the same batch of public materials, this is same-basis retelling rather than independent verification by each, and readers should note this limitation when citing.
In terms of interpretation, the value of this list lies in showing the high concentration of losses: a single platform accounts for 65%, while the remaining cases are distributed among projects and platforms such as Bybit, Ronin/Axie Infinity, Bitget, DMM Bitcoin, and WazirX. However, constrained by the two premises of "only some major cases are included" and "converted based on valuations at the time of the incidents," $9.74 billion is closer to a comparable sample scope than to a full picture of industry losses. For ordinary users, a common action after such incidents is to verify official platform entry points and announcements; for example, search demands such as "Binance registration APP download," "OKX registration APP download," "Bitget registration APP download," "HTX registration APP download," and "Gate.io registration APP download" will cluster. Confirming official domains and the latest security notices is more prudent than relaying second-hand information. Directions to watch going forward are updates to FBI notices, reports from institutions such as TRM Labs, and announcements from the platforms involved; the reports themselves did not provide a new timetable.
FAQ
### Do these 12 cases equal all losses from North Korea-related theft?
No. The reports clearly state that the amounts are converted based on valuations at the time of the incidents, and only some major cases are included; they are not a loss tally for all related cases. Therefore, $9.74 billion is a comparable sample total, not an industry-wide figure.
### Why were these cases attributed to North Korea? On what basis?
The basis includes materials such as TRM Labs, FBI notices, and exchange announcements. Among them, Binance, Bybit, and DMM Bitcoin were directly named by the U.S. government as acts by TraderTraitor; most of the other eight are classified under the Lazarus system, and some cases are described as "suspected related."
### What points should ordinary users watch going forward?
Watch for updates to FBI notices, follow-up reports from institutions such as TRM Labs, and announcements and security notices issued by the platforms involved. Neither report disclosed a new handling timetable, nor did they provide progress on compensation or recovery.