North Korea is believed to have stolen around $9.6 billion in cryptocurrencies since 2019. The figure comes from unfolded, an account specializing in crypto data, which published its tally on October 30, 2026, according to Journal du Coin. The Binance hack of October 29, 2026 alone accounts for two-thirds of that total. Without it, the thefts attributed to Pyongyang fall back to $3.2 billion over six years.
Binance, the world’s largest cryptocurrency exchange, lost around $6.3 billion according to its own figures, as detailed in our article on the Binance hack.
Why does Binance dwarf North Korea’s record?
A single theft exceeds the largest hacks in the sector’s history combined. According to Journal du Coin, the nine largest crypto hacks combined, from Mt. Gox to FTX by way of Bybit, total $5.4 billion. The theft suffered by Binance exceeds that total by around one billion.
The exact amount depends on who is counting. Blockchain analytics firm Chainalysis puts it at $6.4 billion, its competitor TRM Labs at $6.36 billion, and Binance at around $6.3 billion, again according to Journal du Coin. The gap remains small relative to the total.
Until October 2026, the record belonged to Bybit, another exchange. The February 2025 theft there had reached around $1.5 billion, 2clics recalled in its article on Binance.
Which crypto hacks have been attributed to North Korea since 2019?
Unfolded’s table draws on DefiLlama, Chainalysis, the FBI and security firms. Journal du Coin cites its main targets and their amounts.
| Year | Target | Amount cited | Attributed by |
|---|---|---|---|
| 2019 | Upbit exchange | $49 million | Unfolded’s tally |
| 2022 | Ronin bridge of the game Axie Infinity | $624 million | Unfolded’s tally |
| 2025 | Bybit exchange | $1.4 billion according to DefiLlama, around $1.5 billion according to the FBI | FBI |
| 2026 | Drift protocol | $295 million | Security firms |
| 2026 | Kelp DAO protocol | $293 million | Unfolded’s tally |
| 2026 | Bitget exchange | $387 million | Security firms |
| 2026 | Binance exchange | $6.3 to $6.4 billion depending on estimates | Security firms |
Unfolded’s list also includes the Harmony bridge in 2022 and Atomic Wallet in 2023. The year 2026 marks a clear acceleration: Drift, Kelp DAO, Bitget and then Binance all fell this year.
How do North Korean hackers operate?
At Binance, the hackers targeted the connected wallets, or hot wallets. These wallets are used for a platform’s customers’ everyday withdrawals. As the entry point, the company points to the compromised computer of a DevOps engineer, responsible for running the systems. No private key was leaked, according to the company.
Speed is part of the method. According to TRM Labs, cited by Journal du Coin, most of the Binance loot left within about twenty minutes.
Laundering follows immediately. The FBI, the US federal police, described it in its public service announcement of February 26, 2025 on Bybit. The hackers converted part of the funds into bitcoin and other virtual assets. They then dispersed them across thousands of addresses on several blockchains. The FBI expected a final conversion into conventional currency.
The Binance scenario follows the same pattern, according to Journal du Coin:
- hundreds of millions of USDT converted into ether on the decentralized exchange Uniswap;
- around 19,760 ether borrowed on the lending protocol Aave;
- 18,270 bitcoin split into successive small amounts, a technique known as a peel chain;
- the first funds routed through the THORChain protocol, already used after Bybit.
The Bybit precedent gives the timescale. It took the hackers about ten days to launder most of the stolen ether, largely via THORChain, Journal du Coin recalls.
Who attributes these thefts to Pyongyang?
For Bybit, the attribution is official. In its announcement of February 26, 2025, the FBI declared North Korea responsible for the theft of around $1.5 billion, committed on or around February 21, 2025. It calls this activity TraderTraitor. It urges exchanges, bridges, decentralized finance services and analytics firms to block transactions linked to the hackers’ addresses.
For Binance, only private firms have weighed in. Chainalysis attributes the attack to TraderTraitor, a North Korean cell linked to the Lazarus Group. Its argument: funds stolen from Bitget and from Binance were mixed at a common address. TRM Labs reaches the same conclusion “with a high degree of confidence”, according to Journal du Coin.
Elliptic, another analytics firm, is more cautious. It considers the attribution “probable”, since the overlap concerns only $39,000 of Binance funds. No government has confirmed it, and the FBI has not commented. Unfolded itself specifies that for Binance, Bitget and Drift, the attribution comes from security firms. Drift may be the work of a North Korean unit distinct from Lazarus.
How much of the loot could be blocked?
Stablecoin issuers froze a significant share of the Binance funds, according to Journal du Coin:
- Tether: around 1.77 billion USDT;
- Circle: 823 million USDC;
- Ripple: 40.5 million RLUSD;
- World Liberty Financial: 27.8 million USD1;
- the Arbitrum network’s security council: 8,426 ether.
Elliptic counts $2.84 billion frozen, or 44% of the loot. Binance puts the figure at 3 billion. Elliptic estimates that $3.3 billion remains out of reach, spread across some forty addresses. A freeze is not a restitution: the blocked funds still have to be returned through a separate operation.
Exchange security: what does Switzerland require of crypto service providers?
In Switzerland, several existing rules govern crypto service providers. They cover custody, traceability of transfers and sanctions.
On January 12, 2026, the Swiss Financial Market Supervisory Authority (FINMA) published FINMA Guidance 01/2026, which specifies how it assesses the custody of crypto assets. In it, FINMA describes the risks associated with holding bitcoin or ether, which are based on distributed ledgers. Managing them requires, according to FINMA, “specific knowledge and a robust technical infrastructure”.
Using a foreign custodian does not relieve the Swiss institution of its obligations. FINMA requires custodians that are adequately supervised, in Switzerland and abroad, and clear protection rules in the event of bankruptcy. Clients’ crypto assets must not fall into the custodian’s bankruptcy estate. Responsibility always lies with the authorized institution.
Traceability is ensured by FINMA’s travel rule. FINMA Guidance 02/2019 subjects crypto transfers to the same information rules as a bank transfer. In the absence of a transmission system on the blockchain, a supervised institution may only send crypto to the external wallets of its own identified clients.
The first level remains the Anti-Money Laundering Act (AMLA). Providing wallets and trading virtual currencies are subject to it, with membership of a self-regulatory organization. Accepting crypto assets from the public may fall under the FinTech license. The details are in our page on FINMA crypto authorization.
Sanctions against North Korea also apply. The Federal Council adopted coercive measures on October 25, 2006, because of North Korea’s nuclear program. The ordinance of May 18, 2016 (SR 946.231.127.6) brings them together, according to the State Secretariat for Economic Affairs (SECO). It provides for the freezing of assets and economic resources and the obligation to report frozen assets. It also prohibits financial transactions linked to the nuclear and missile programs. The SECO page does not specifically mention crypto assets.
What this means for a client in Switzerland
The first reflex is to check who holds your crypto. Binance says it has no fixed central headquarters. Since early 2026, its global business has mainly run through supervised companies in Abu Dhabi, finews.ch noted, as cited by 2clics. For a client in Switzerland, it is therefore a foreign platform.
An authorized institution does not eliminate all risk. If a FinTech institution goes bankrupt, client funds are neither privileged nor covered by deposit insurance. FINMA publishes two sections to consult before opening an account: “Authorized institutions” and “Warning list”. Our article on FINMA’s warning list explains how to use it; the list is neither exhaustive nor always up to date.
A promise of reimbursement remains a statement by the platform. Binance has committed to covering the losses with its SAFU reserve fund and its own funds. No third party guarantees this commitment. The general framework is summarized in our page FINMA and cryptocurrencies.
What we don’t know yet
- The official attribution of the Binance theft: the FBI, which named TraderTraitor for Bybit within five days, has not commented.
- The fate of the $3.3 billion still out of reach according to Elliptic, and the return of the frozen funds to Binance.
Sources
- Journal du Coin: Crypto hacks: North Korea has stolen $9.6 billion since 2019
- FBI (IC3): North Korea Responsible for $1.5 Billion Bybit Hack, announcement of February 26, 2025
- FINMA: guidance on the custody of crypto assets, January 12, 2026
- SECO: measures against North Korea
