BitOK: North Korean-linked Crypto Theft Reached $7.61 Billion in 2026

A reported shift from code exploits to compromised signing systems

Blockchain intelligence firm BitOK estimates that North Korean hackers stole $7.61 billion in cryptocurrency across 38 incidents between January and October 2026. The report identifies six major attacks and says they relied on taking control of the people or systems that authorize withdrawals, rather than exploiting code. That distinction matters for security reviews: the reported attack path began outside the smart-contract logic that standard code audits are designed to examine.

BitOK says $2.86 billion was frozen or seized, leaving $4.75 billion beyond reach. Binance accounts for $6.41 billion of the reported total, while 32 smaller thefts targeting individuals and firms add up to $178.4 million. These figures describe a highly concentrated set of losses, with one exchange making up most of the reported value. They also show that recovery through intervention did not keep pace with the amount stolen.

The figures cover a defined period, January through October 2026, and are estimates attributed to BitOK. The report’s central finding is not that code security has become irrelevant, but that checks on code alone did not prevent the six largest incidents. In each, withdrawals carried valid signatures or passed ordinary controls. The source does not specify how BitOK calculated its total estimate, so the reported sums should be understood as the firm’s assessment.

How attackers gained authorization

At Binance, BitOK identifies a DevOps engineer’s laptop and a signing-service container as the attackers’ entry point. That account is consistent with earlier findings cited in the source about the October incident. The report therefore places the compromise in the tools and access used to authorize withdrawals, not in an identified flaw in the withdrawal code itself. The source does not detail the full sequence by which the laptop or container was compromised.

Other major cases involved different systems: multisig signers at Drift, a Solana-based trading platform; a single bridge verifier at KelpDAO; and Bitget’s wallet system. These examples span trading, bridging and exchange infrastructure, but BitOK describes a common outcome: valid authorization was obtained or normal checks were satisfied. The practical security concern raised by the report is that protecting each application’s code may not be enough if the signing process can be taken over.

Before each heist, the operators tested the precise route with small amounts, according to BitOK. In the Binance case, the attack contract was publicly active four hours before the theft. That detail suggests the operation included a test phase visible on-chain before the large transfer. It does not establish what monitoring was in place or whether the test could have been recognized at the time, but it shows why small preliminary transactions can be relevant to investigation.

The race to move funds and the limits of freezes

BitOK’s sample of 540 transactions also shows a schedule that looked more like a workday than continuous activity: 48% occurred between 4 p.m. and 9 p.m. Pyongyang time, and the report recorded no activity on North Korean public holidays. Saturday, Sunday and Monday together accounted for only 10% of transactions. Those patterns may help describe operator behavior, though the source does not say that timing alone can identify who initiated a particular transfer.

Once an attack began, the pattern changed. The report says scripts took over and fund movements continued around the clock. That contrast between a comparatively regular operating schedule and automated, continuous movement after an incident is relevant to investigators tracing transactions. It also means that an initial compromise can lead quickly into activity that is not constrained by the same apparent work-hour pattern. BitOK does not identify the specific automation tools used.

Speed is central to whether funds can be frozen, BitOK says. Within minutes of theft, the operators swapped stablecoins into ETH or borrowed ETH against stolen collateral; the report notes that ETH cannot be frozen by an issuer. After the April rsETH bridge exploit, 52,440 ETH left lending protocols in just over eight minutes. This leaves a narrow period for interventions involving assets that still have an issuer able to freeze them.

A small transaction trail links separate attacks

The laundering process could then pause before funds moved again. After the rsETH incident, assets reportedly sat idle for 2.5 to 5 days before scripts routed them through THORChain, a cross-chain swap protocol. BitOK also counted 2,257 Binance-linked swaps worth $55.8 million, with total costs of 0.50%. The figures indicate that, in this sample, moving funds through swaps was relatively inexpensive; they do not establish the cost of every attack’s laundering.

The difference in recovery rates illustrates the limits of freezes. BitOK says 43% of the funds stolen from Binance were frozen or seized, compared with 6% across all other major attacks combined. Even in Binance’s case, timing mattered: Tether received its first freeze request 34 minutes after the withdrawal, by which point 345 million USDT had left the original address. The report says freezes worked only on stablecoins that had not yet moved.

A cleanup mistake provided another investigative lead. After routing 5,047 ETH through Umbra and the Stargate bridge, an operator swept leftover dust into one wallet; on August 31, 150 addresses emptied into it within three minutes and 36 seconds. The collector received just 0.27 ETH, but shared settlement addresses link five attacks, from KelpDAO in April to Binance in October. BitOK sees one laundering operator, while allowing that different teams may have conducted the hacks.

Source: BeInCrypto