North Korean Hackers Stole $7.61 Billion in 2026 Without Touching the Code

North Korean hackers pulled in an estimated $7.61 billion in crypto across 38 incidents between January and October 2026, per blockchain intelligence firm BitOK, and the number that should bother you isn't the $7.61 billion. It's the zero. No code exploits in the six largest attacks.

How the year went

BitOK's tally runs from January through October, 38 incidents in all. Six of those were the big ones, and they share a fingerprint. The attackers didn't find a bug in a smart contract. They found the humans and machines that authorize withdrawals and took those over instead.

That's a slower, quieter kind of heist. You don't need a zero day. You need patience, a phishing kit, and a signer who trusts a screen.

Then came the clawback phase. Freezes and seizures recovered $2.86 billion. Solid work from the responders, admittedly. But $4.75 billion walked out the door and stayed gone, which puts roughly 62 percent of the stolen haul somewhere the good guys can't reach.

And Binance alone accounts for $6.41 billion of the total. Read that again. One exchange, most of the year's losses. The other 32 incidents, spread across individuals and smaller firms, add up to a rounding error by comparison.

What actually broke

Here's the uncomfortable part. Nothing in the code broke. Multisig worked exactly as designed. The contracts did what the contracts said. What failed was the assumption underneath all of it, that the person clicking approve is who they claim to be and sees what they think they see.

The question worth asking: what's the point of a seven-figure audit if the withdrawal gets signed on a compromised laptop? The industry has been slow to answer that. Security budgets still tilt hard toward contract review and bug bounties, because those are legible line items on a spreadsheet. Key ceremony hygiene, signer hardware, and the boring discipline of verifying a transaction out of band don't demo well at conferences.

Color me skeptical, but I don't think another audit shop fixes this. The spending is aimed at the wrong target, and it's been aimed there for three years running.

What to watch

Watch the freeze numbers first. If $2.86 billion becomes $3.5 billion or more by the next BitOK report, that tells you exchanges, issuers, and law enforcement are getting faster inside the 48-hour window that decides whether stolen funds get sticky. If it barely moves, the recovery playbook is mostly theater.

Watch Binance too, since $6.41 billion in a single venue is a concentration problem nobody wants to own in public. And watch whether signer compromise starts showing up in the small-incident bucket, the 32 thefts that barely made headlines. Attackers industrialize whatever works.

The thesis is simple, even if it's unpleasant. North Korea's crypto operation stopped being a hacking story and became an operational security story, and the defenders are still buying the wrong insurance. I'm not entirely convinced the industry reprices this risk before the next nine-figure hit. History suggests otherwise. Time will tell, though.