North Korea's 2026 crypto thefts pass $1 billion
Elliptic links the Bitget hack to North Korea-backed hackers, citing laundering patterns and wallets tied to the record $1.5 billion Bybit theft.
By Dev Okafor · Published · Updated · 4 min read
North Korea-linked hackers have now stolen more than $1 billion in cryptocurrency this year, according to blockchain analytics firm Elliptic, after attributing the Bitget exchange hack to the regime, Bloomberg Law reports.
The evidence
Elliptic pointed to how the stolen funds were moved and laundered, which matched past attacks blamed on North Korea's hacking units. Some of the money also touched addresses connected to earlier thefts, including the $1.5 billion Bybit hack in 2025 — the largest crypto theft on record.
Blockchain tracker MistTrack later flagged suspected North Korean scripts moving Bitget funds through the CoW Protocol and Chainflip swap services, Bitcoin.com reported.
Why North Korea targets crypto
The United Nations and Western governments say stolen crypto helps fund North Korea's weapons programs while it is cut off from the global financial system by sanctions. Its hackers favor:
- Exchange infrastructure: compromising the systems that sign or approve withdrawals.
- Fake job offers: sending malware-laden "coding tests" to engineers at crypto firms.
- Supply-chain attacks: breaking into software vendors used by their real targets.
What crypto companies should do
- Treat any vendor with access to wallet systems as part of the attack surface.
- Require several independent approvals for large withdrawals.
- Train engineers to spot recruitment lures and never run code from unknown "recruiters" on work devices.
