What if almost nine out of every ten dollars stolen from cryptocurrency platforms this year could be traced to the same group of actors? That is exactly the picture emerging from the latest industry tracking. The numbers landed recently and they are hard to ignore. Suspected North Korea-linked operations have accounted for nearly 89 percent of reported cryptocurrency hack losses so far in 2026. I have followed these reports for years, and the jump from earlier levels still surprises me.
The Scale Of The Problem In 2026
The data covers reported losses through late October. Across the wider period that begins in 2021, the same actors stand behind roughly 59 percent of the total $22.34 billion in recorded cryptocurrency hack losses. That works out to about $13.24 billion over those years. The annual share has climbed sharply. In 2021 it sat at only 15 percent. The gap is more than seventy percentage points.
Perhaps the most striking change sits in the size of each individual incident. The average loss tied to these suspected operations now reaches approximately $185.65 million. Compare that with the $50.65 million figure from 2021 and the difference is clear. Attacks have grown fewer in some recent years yet far more damaging when they succeed. In my view that shift matters more than the raw percentage alone.
How The Numbers Evolved Year By Year
Looking back at the previous full year helps put the current figures in context. Researchers estimated that these actors moved roughly $2.02 billion in 2025. That total sat 51 percent higher than the year before even though the number of separate incidents declined. Cumulative thefts through the end of 2025 reached about $6.75 billion. The trend line has pointed upward for some time.
Three large breaches in that earlier year already explained 69 percent of the service losses. A single February incident alone accounted for $1.5 billion. Concentration like that makes the ecosystem more fragile than a long list of smaller events would. When a handful of successful operations can move the yearly totals so dramatically, every platform sits under pressure.
Recent High-Profile Incidents And Their Impact
One major exchange suffered a breach in late October that investigators valued above $6 billion. The platform later stated that customer assets worth roughly $6.3 billion had been affected and pledged to cover the losses from its own reserves and dedicated user protection fund. Another large platform had been hit the previous month. Blockchain analysis later connected funds from both events.
That connection proved important. Investigators watching the movement of stolen assets noticed that coins taken from the later breach mixed with coins taken from the earlier one. The firm tracking the activity called the link its strongest piece of evidence for attributing both events to the same set of actors. Separate analysis from another specialist group reached the same conclusion with high confidence and valued the later transfers at about $6.36 billion using prices at the moment of the theft.
The direct mixing of assets from two separate exchange breaches provided the clearest on-chain signal yet of coordinated activity.
Preparations for the larger incident appeared to begin at least thirty-six hours earlier. Small withdrawals from mixing services, deployment of attack code, and wallet rehearsals all showed up in the record. On one major network the operators used pre-signed authorizations. On others they simply sent ordinary signed transfers. The technical details differ, yet the overall approach stays consistent with earlier campaigns.
Common Methods Behind The Thefts
Researchers have described several recurring techniques. Some involve placing skilled information-technology workers inside cryptocurrency services under false identities. Others rely on sophisticated impersonation of executives to gain access or approval. Across centralized platforms the attacks frequently target signing processes and private-key infrastructure. In some cases legitimate signers have been tricked into approving malicious transactions.
These methods do not require breaking every technical control. Social engineering and insider access often prove enough. Once the operators hold the ability to move funds, the rest of the process moves quickly. I have found that the human element remains the weakest point more often than pure cryptographic failure.
- Embedding workers inside target organizations under assumed identities
- Impersonating senior executives to obtain approvals or credentials
- Targeting multi-signature and private-key management systems
- Tricking authorized signers into confirming harmful transactions
After the funds leave the original wallets the laundering phase begins. In the recent large case, investigators watched thousands of transactions in which assets circulated repeatedly between addresses, sometimes returning to wallets used earlier in the sequence. Many addresses first received a tiny amount of a particular token before accepting and forwarding larger sums. The repeated pattern pointed to an automated distribution process.
During the early effort to avoid stablecoin freezes, roughly $500 million in stablecoins moved into a single wallet used for swaps. Over a short window of nearly twenty minutes, $325 million converted into about $285 million of another major asset. The remaining portion headed to intermediary wallets. Speed and volume both served to complicate tracking and recovery efforts.
How Stolen Funds Move After The Breach
The laundering patterns observed after major incidents follow a recognizable script. Assets hop across multiple chains. They pass through mixers or successive layers of intermediate wallets. Small test transfers often precede larger movements. Automated scripts appear to handle the bulk of the distribution once the initial extraction succeeds.
In the October case the platform later announced that it had set aside more than $6.34 billion to replace affected assets. It also began buying back stolen alternative tokens using major cryptocurrencies and stablecoins. That response protected users in the short term, yet it also highlighted how expensive a single successful operation can become for even well-capitalized platforms.
The Diplomatic Response And Its Limits
While the technical investigations continued, a separate diplomatic statement appeared. An unnamed foreign ministry spokesperson rejected a multinational push to enforce existing sanctions. The spokesperson stated that sanctions and pressure may work on the weak but never on the country in question, referring both to economic measures and to its nuclear weapons status.
The joint statement that prompted the reply had been issued by eleven countries and a major regional bloc. It focused on overseas workers, malicious cyber activities, and certain forms of military cooperation. The signatories called on all United Nations members to implement existing Security Council resolutions and cited reporting from a multilateral monitoring team formed after an earlier expert panel mandate ended.
Whether stronger enforcement will change the calculus behind these operations remains an open question. Past experience suggests that revenue from cryptocurrency theft continues to matter for programs that face other funding constraints. The public rejection of the latest sanctions push does not signal any near-term shift in behavior.
Why Average Losses Keep Rising
Several factors help explain the larger average haul per incident. Platforms now hold greater concentrations of value. Attackers have refined their techniques over multiple campaigns. Once access is obtained, the operators move quickly and at scale. The combination produces fewer successful breaches yet far higher individual totals.
The 2025 figures already showed this pattern. Fewer attacks produced a 51 percent increase in total value stolen. The current year has continued the same trajectory. When a single incident can exceed six billion dollars, the yearly percentage attributed to one set of actors climbs rapidly even if the absolute number of events stays modest.
| Period | Share Of Total Losses | Average Per Incident |
| 2021 | 15 percent | $50.65 million |
| Through 2025 cumulative | Significant portion of $6.75 billion | Rising steadily |
| 2026 year-to-date | Nearly 89 percent | $185.65 million |
That table captures the direction of travel. The share has expanded dramatically while the cost of each successful operation has more than tripled from the earlier baseline. Defenders face a moving target that grows more expensive with every major success on the other side.
What Platforms And Users Can Observe
Several practical observations emerge from the recent cases. First, the speed of laundering has increased. Automated scripts move funds across chains and through intermediate wallets within minutes. Second, mixing services and successive hops remain common tools even when some jurisdictions attempt to restrict them. Third, the connection between separate incidents can sometimes be established through on-chain analysis when operators reuse infrastructure or mix funds from different sources.
Users of centralized platforms have limited direct control over the security of signing systems or private-key infrastructure. Still, awareness of the broader risk environment helps. Diversification across platforms, careful attention to withdrawal limits, and understanding of how protection funds work can reduce personal exposure. None of these steps eliminates systemic risk, yet they remain practical responses available to individuals.
In my experience the platforms that recover most effectively are those that maintain substantial reserves and communicate clearly after an incident. The decision to cover user losses from company resources and a dedicated fund prevented a deeper loss of confidence in the most recent large case. That approach is expensive, but the alternative can prove more costly over time.
Broader Implications For The Ecosystem
The concentration of losses with one set of actors raises longer-term questions. Insurance markets, platform capitalization requirements, and regulatory expectations all face pressure when a single campaign can remove billions in a day. Smaller platforms without comparable reserves sit in a more vulnerable position. The industry as a whole absorbs the reputational cost even when individual firms manage to make users whole.
Blockchain transparency cuts both ways. It allows investigators to follow funds and sometimes connect separate incidents. At the same time it gives sophisticated operators a clear map of where value sits and how it moves. The cat-and-mouse dynamic has existed for years. The current numbers simply show that one side has gained ground.
Perhaps the most interesting aspect is how little the underlying motivation appears to have changed. Revenue generation for constrained programs remains the driving force. Technical sophistication has increased, yet the strategic purpose looks consistent with earlier assessments. That continuity suggests the problem will not disappear because of any single set of sanctions or technical defenses.
Looking Ahead With Realistic Expectations
No one can predict the next major incident with certainty. What the data does show is a clear pattern of escalating average losses and a rising share of total yearly damage attributed to the same actors. Platforms will continue to harden signing processes and private-key systems. Investigators will keep refining on-chain and off-chain methods. Users will keep seeking safer ways to hold value.
Whether those efforts can bend the curve remains uncertain. The jump from 15 percent of losses in 2021 to nearly 89 percent in the current year happened in a relatively short period. Reversing that trend will require sustained improvement across technology, operations, and international coordination. Progress on any one front alone is unlikely to prove sufficient.
I keep returning to the average loss figure. When each successful operation removes close to $186 million on average, and when a single event can exceed six billion, the margin for error shrinks for everyone involved. The industry has absorbed large shocks before. The question now is how many more it can absorb at this scale before structural changes become unavoidable.
The latest numbers do not paint a comforting picture. They do, however, provide a clear baseline. Anyone watching the space can measure future progress against the 89 percent share and the elevated average loss. That transparency, at least, offers a way to track whether defenses are catching up or continuing to lag.
The story of cryptocurrency theft in 2026 is still being written. The early chapters already show a heavy concentration of damage linked to one persistent set of actors. How the rest of the year unfolds will depend on whether platforms, investigators, and policymakers can raise the cost of these operations enough to change the calculus. For now the numbers stand as a stark reminder of the stakes involved.
