How North Korea stole over $1 billion in crypto in 2026, and where it went

Key findings

North Korea-linked operators have stolen more than $1 billion in crypto so far in 2026, across 51 or more suspected incidents. Three heists, at Drift Protocol, KelpDAO and Bitget, account for about $965 million of that, and each followed the same five-step playbook. Less than 9% of the money from those three has been frozen. Alongside the big heists, a fake-recruiter campaign quietly drained more than 7,000 wallets belonging to ordinary users and developers. This week, on 20 and 21 October, wallets tied to the Drift theft pushed about 44,510 ETH (about $109M) into the Tornado Cash mixer, and still hold roughly 56,569 ETH.

01 · The big picture

One state, most of the losses

Crypto lost nearly $2.7 billion to hacks and exploits in the first nine months of 2026. A growing slice of that ends up with one country. North Korea's share of all hack losses has risen from under 10% in 2020 to 64% in 2025, and 76% in the first four months of this year. Its cumulative haul now stands at $6.75 billion or more.

Governments treat this as a security issue, not just a crime wave. In October 2025, the 11-country Multilateral Sanctions Monitoring Team reported that North Korea's crypto theft helps fund its nuclear and ballistic missile programmes.

On the government record

Feb 2025 · FBI

Attributed the $1.5B Bybit theft to TraderTraitor, a North Korean group, and published the laundering addresses.

Oct 2025 · Multilateral Sanctions Monitoring Team (11 countries)

Reported that crypto theft and overseas IT workers help fund North Korea's weapons programmes.

18 Sep 2026 · Japan, US, Australia, Germany

Jointly attributed the WaterPlum fake-recruiter campaign to North Korea.

02 · Timeline

2026, month by month

The year's thefts came in bursts: a spring double strike on decentralised finance, a slow campaign against developers, and the year's largest heist in September. Laundering followed in waves, sometimes months later.

03 · Case file: Drift Protocol

The six-month con

Drift is a derivatives exchange on Solana. For about six months, the attackers posed as a quantitative trading firm. They met Drift contributors in person at conferences and deposited more than $1M of their own money to look legitimate. Meanwhile, they compromised Security Council members' devices through weaknesses in the developer tools they used every day, and gained admin access.

Pre-signed transactions sat dormant for over a week, and a Security Council migration with no timelock removed the last safety delay. On 1 April, a counterfeit token was accepted as collateral and the vaults were drained in about 12 minutes. Total value locked fell from $550M to under $250M within an hour. An investigation commissioned by Drift attributed the attack to North Korean state-linked operators.

04 · Case file: KelpDAO

The bridge that trusted a lie

KelpDAO issues rsETH, a token backed by restaked ether, and moves it between chains with a LayerZero-powered bridge. On 18 April, a forged cross-chain message unlocked 116,500 rsETH, about 18% of supply and worth about $292M. Critics pointed to KelpDAO's 1-of-1 verifier setup: one checker, one point of failure. The bridge provider attributed the attack to TraderTraitor, the North Korean group the FBI blamed for the 2025 Bybit theft.

The attackers posted the unbacked rsETH as collateral to borrow real ETH, causing a liquidity crunch across DeFi. On Arbitrum, the Security Council froze about $71M with input from law enforcement. The rest moved through THORChain, a network for swapping between blockchains without a central exchange, whose daily volume hit $394M, more than 10x normal. Some funds mixed with wallets linked to that $1.5B Bybit theft.

05 · Case file: Bitget

The year's biggest heist

On 24 September, Bitget, one of the largest centralised exchanges, lost $387.5M (first reported as $351.6M). According to investigators working with Bitget, the attackers used a zero-day, a flaw unknown to the vendor, in two third-party security appliances, then moved through the network to the server that runs wallet jobs. A custom tool fed Bitget's systems false data, so they approved the withdrawals themselves. No private keys were stolen.

Bitget detected the theft at 18:31 UTC; about $183M had left within roughly an hour. On Arbitrum, 19.67M USDT became about 7,111 ETH in some six minutes. Stolen XRP was later traced into bitcoin, and proceeds entered THORChain. Bitget's User Protection Fund, worth more than $464M, covers the full loss. Bitget said the methods closely match known North Korean operations, citing IP and on-chain evidence.

06 · The quieter threat

WaterPlum: the job interview that empties your wallet

Not every theft targets an exchange. From December 2025 to July 2026, a North Korean group posed as tech recruiters and sent developers a "coding test": a malicious code package or project. Running it installed malware that hunted for wallets and seed phrases. About $10.7M (1.7 billion yen) moved to North Korea. On 18 September, Japan's National Police Agency and National Cybersecurity Office, with agencies in the US, Australia and Germany, jointly attributed the campaign, also known as Contagious Interview, to North Korea's Bureau 313.

07 · Pattern analysis

One playbook, run again and again

Put the cases side by side and the method barely changes. Access is slow and patient; the drain takes minutes. Funds hop to Ethereum, where trading is deepest, and freezable stablecoins are dumped for ETH. The exit runs through THORChain to bitcoin, mixers or privacy coins. The FBI described the same pattern after the 2025 Bybit theft: fast conversion into bitcoin, spread across thousands of addresses. About 83% of Bybit's stolen ETH became bitcoin, most of it via THORChain.

08 · Recovery

How much was stopped, and where

Freezes only happen at chokepoints: networks with emergency security councils, like Arbitrum, and stablecoin issuers such as Circle and Tether, which can block the tokens they issue. ETH and bitcoin have no issuer, so once stolen funds are converted, nobody can freeze them. Across the three big heists, about $81M of roughly $965M has been frozen, under 9%.

09 · What this means for you

Lessons by audience

The same playbook leaves different openings for different people. These are the practical steps that would have blunted this year's attacks.

Individuals and developers

• Never run recruiter test code on a machine that holds wallets.

• Keep seed phrases off computers entirely.

• Treat urgent "security alerts" as phishing until proven otherwise.

Exchanges and compliance

• Screen inbound deposits for exposure to exploiter clusters, including indirect hops.

• Make sure alerts land in minutes, not the next morning.

Protocols and builders

• Put timelocks on admin actions.

• Avoid single-verifier bridges.

• Audit signers' security appliances and developer tools, not just contracts.

10 · Evidence

Verify it yourself

These exploiter-labelled addresses are public. Anyone can open them on Etherscan and follow the transactions described above.

Labels are Etherscan's. Addresses that received funds from these wallets, such as exchanges, bridges and mixers, are infrastructure, not implicated parties.

11 · How Nodestors approaches this

From raw transactions to a traceable story

Following stolen funds by hand means hopping between block explorers, one chain at a time, while the attacker moves in minutes. Bridges break the trail, labels go stale, and exposure two or three hops away goes unseen. Nodestors structures raw blockchain data across chains so wallets, clusters and flows can be traced as one connected picture.

See your exposure before it becomes a loss

The Wallet Intelligence System traces wallets across chains and flags exposure to exploiter clusters, including indirect hops, so compliance and security teams can act while funds are still in reach.

Let’s connect →

Methodology and sources

Compiled from public on-chain records for exploiter-labelled addresses, government sources and public disclosures by the affected platforms. Government sources: FBI public service announcement I-022625-PSA (February 2025); the joint attribution of WaterPlum by Japan's National Police Agency and National Cybersecurity Office with agencies of the United States, Australia and Germany (18 September 2026); and the Multilateral Sanctions Monitoring Team report (October 2025). Public sources: incident statements from Drift, KelpDAO, Bitget and the Arbitrum Security Council, and address labels on the Etherscan block explorer. Aggregate loss figures and shares are drawn from published industry estimates. Dollar values are estimates at the time of each event. Reported Drift losses range from $270M to $295M; this report uses about $285M. Drift balances reflect on-chain tracking as of 21 October 2026 and may change.

Government sources

• FBI: North Korea responsible for $1.5 billion Bybit hack (I-022625-PSA)

• Ministry of Foreign Affairs of Japan: joint attribution of WaterPlum to North Korea (18 Sep 2026)

Disclaimer

Attributions reflect assessments by the named government agencies and affected platforms. On-chain movement does not by itself establish identity. Exchange, bridge and protocol addresses that received funds are infrastructure, not implicated parties. This report is not financial, legal or investment advice.

nodestors.com · Infrastructure for digital asset intelligence · © 2026 Blockline Innovations Private Limited