North Korea Tied to $6.3B in Stolen Crypto, and the Trail Ends at One Address

How does $6.3 billion in stolen crypto move through the same pipes for years without anyone shutting the valve? Ask a chain analyst. Or just ask the blockchain. It's been talking the entire time and nobody in a nice office wanted to listen.

TRM Labs now says it has high confidence that North Korea is behind a theft stack totaling $6.3 billion. High confidence. Not "possibly linked," not "under review." That's a firm doing the unfashionable thing and committing to an attribution in public.

Here's the detail that matters more than the number. Independent investigator ZachXBT traced stolen funds from both the Binance and the Bitget incidents and found them converging on a single address. Same wallet. Two different jobs.

That's not a coincidence. That's a supply chain.

The Raw Numbers

Start with $6.3 billion, because the scale is the story and also the alibi. A number that large gets filed under "sophisticated state actor" and then everyone goes back to their coffee, as if sophistication were a weather event we can't influence.

Then there's the two-in-one finding. Binance and Bitget are separate exchanges, separate security postures, separate incident reports, separate PR apologies. And yet the stolen funds from both ended up at the same address on the way out. One consolidation point. One laundry room.

The timing matters too. Binance's original breach was years ago, back when the industry was smaller and the excuses were thinner. That funds from that era are still moving alongside money from a more recent Bitget incident tells you the exit routes were never really closed. They were just relabeled.

Which seems like an even stronger argument for treating address-level intelligence as infrastructure rather than a line item. Naturally, most exchanges still treat it as a cost center.

This Is a Pattern, Not an Incident

None of this is new. It's a rerun with a bigger budget.

The Ronin bridge lost roughly $625 million in March 2022. Harmony's Horizon bridge bled about $100 million that June. Bybit got hit for close to $1.46 billion in February 2025. The 2019 Binance hack was around $40 million, which at the time felt apocalyptic and now reads like a rounding error.

Trace the arc and you get a straight line upward. Every year the heists get larger, the attribution gets faster, and the recovery rate stays embarrassing. That gap between how good we're at identifying thieves and how bad we're at stopping them is the industry's real balance sheet.

Crypto built the most transparent financial ledger in human history and then acted shocked when the transparency turned out to be a mirror. Traders can see every hop, every mixer deposit, every bridge. So can TRM Labs. So can ZachXBT, working alone, presumably with too much caffeine and a decent node.

So why does the same address keep showing up?

Because consolidation is cheap and consequences aren't. Because an exchange that freezes a large deposit risks an angry customer and a legal bill, while an exchange that quietly processes it risks nothing until a report lands two years later. Optics win over accountability every single time. I've seen enough.

Here's my first hot take, and it's not a comfortable one. The compliance apparatus at most exchanges is designed to produce documentation, not outcomes. It generates screenshots for regulators and dashboards for boards. It doesn't, as a rule, stop a $6.3 billion flow from walking out the front door in batches sized to avoid triggers. That apparatus has a budget. The thieves have a roadmap. Spare me the roadmap.

Second take. The only genuinely growing business in crypto security is the analytics layer, and the exchanges keep funding it as a grudging expense instead of a moat. Chain intelligence firms get paid to know where the money went. Exchanges get paid to pretend they didn't. Only one of those models survives the next cycle.

What Investigators Are Saying

According to TRM Labs, the North Korean attribution clears a high-confidence bar, which in this discipline is about as close to a courtroom statement as you get without a subpoena. The firm hasn't hedged. That's worth noting precisely because hedging is the industry default.

ZachXBT's contribution is different in kind. He's not selling software. He's following the money in public and posting the receipts. When a lone researcher can link two separate exchange breaches to one wallet before the compliance departments finish their slide decks, the slide decks are the problem.

Traders I've talked to aren't panicking about this. They're pricing it. Large depositors have quietly started favoring venues that publish wallet rotation schedules and post-incident reports with actual timestamps in them. Not because they care about North Korea. Because they care about getting their own money back if something goes sideways.

That's the market vote nobody writes about. Trust as a fee.

What to Watch Next

Three concrete things, no hand-waving.

First, watch for wallet rotations at any exchange whose historical hot wallets appear in the TRM or ZachXBT trails. If an exchange announces new deposit addresses without explaining why, that's not housekeeping. That's a confession with better lighting.

Second, watch the mixer inflow numbers in the weeks after each new attribution report. Historically, laundering activity spikes briefly, then redistributes into smaller, slower flows once public eyes move on. The pattern is predictable, which is exactly why it keeps working.

Third, watch sanctions actions. Attribution reports tend to precede formal designations by a quarter or two. Any address publicly named by TRM Labs is a candidate for a designation, and any exchange caught servicing it afterward loses the argument about plausible deniability.

And keep one number in your head. $6.3 billion. Not because it's the final total, but because it's the current one. It will grow. The only open question is whether it grows faster than the industry's willingness to do the boring work of blocking addresses before the money moves, not after.

The blockchain has already filed its report. The industry just keeps declining to read it.