North Korean Hackers Stole $7.61B in Crypto by Targeting Signing Systems

Between January and October 2026, North Korean operatives siphoned approximately $7.61 billion in digital assets through 38 separate incidents, according to blockchain intelligence firm BitOK. Rather than exploiting software vulnerabilities, the six largest breaches involved taking control of the individuals and infrastructure responsible for authorizing withdrawals.

Freezes and asset seizures recovered $2.86 billion, leaving $4.75 billion inaccessible to authorities. Binance accounted for $6.41 billion of the overall figure, while 32 smaller thefts targeting individuals and companies totaled $178.4 million.

Why Code Audits Did Not Stop North Korean Hackers

The BitOK report notes that every withdrawal in the six biggest incidents carried legitimate signatures or passed standard validation checks. At Binance, the breach originated from a DevOps engineer's laptop and a container used for signing services.

That finding aligns with earlier insights into how the hack occurred in October. In other cases, attackers compromised multisig signers at Drift, a Solana-based trading platform, a single validator at KelpDAO's bridge, and the wallet system at Bitget.

Before each heist, the actors tested the exact method using small sums. The Binance attack contract, for instance, operated publicly four hours before the theft.

The timing of activity suggests a standard workday. In a sample of 540 transactions, 48% took place between 4 p.m. and 9 p.m. Pyongyang time.

The operators also took North Korean public holidays off, with no transactions recorded on those days. Activity on Saturday, Sunday, and Monday combined represented just 10% of all transactions.

Once an attack began, however, the pattern shifted. Automated scripts took over, and fund movements continued around the clock.

Minutes to Swap, Days to Vanish

Speed determines what can still be frozen. Within minutes, North Korean hackers converted stablecoins into ETH or borrowed ETH using stolen collateral, since no issuer can freeze ETH.

After the April rsETH bridge exploit, the first 52,440 ETH left lending protocols in a little over eight minutes. Those funds then remained inactive for 2.5 to 5 days before scripts moved them through THORChain, a cross-chain swap protocol.

Laundering proved inexpensive. Across 2,257 Binance-linked swaps totaling $55.8 million, the combined expenses reached just 0.50%.

Freezes were effective only where stablecoins had not yet been moved. At Binance, 43% of stolen assets were frozen or seized, compared with 6% across all other major attacks combined.

Even at Binance, timing created problems. Tether received its first freeze request 34 minutes after the Binance withdrawal. By that point, 345 million USDT had already left the original address.

A 0.27 ETH Slip Ties 5 Attacks Together

The strongest link came from a cleanup mistake. After moving 5,047 ETH through Umbra, a stealth-address privacy tool, and the Stargate bridge, the operator funneled leftover dust into one wallet.

On August 31, 150 addresses emptied into that collector within 3 minutes and 36 seconds. That sweep connected the AFX and August 28 thefts, and Bitget addresses followed in September. In total, the wallet received only 0.27 ETH.

Shared settlement addresses now link five attacks by North Korean hackers, from KelpDAO in April to Binance in October. BitOK says this indicates a single laundering operator, though different teams may have executed the hacks.

“Tiny residual balances became the operator’s clearest trail of the year,” BitOK said

Signing Keys Are the New Attack Surface

Chainalysis had already linked the Bitget theft to North Korea in October. BitOK's data now reveals how North Korean hackers repeat a single playbook across exchanges and DeFi protocols.

The vulnerability has shifted from smart contracts to employees, devices, and signing services. Issuer freezes help only in the first minutes, and Binance has since covered most user losses from its own reserves.