Statistics: North Korea-linked hackers involved in 37 crypto theft cases over nine years, totaling over $11.8 billion

on October 30, according to TechFlow statistics, hackers linked to Lazarus and North Korea were involved in 37 crypto theft cases between 2017 and 2026, with reported combined valuations totaling approximately $11.817 billion.

The most recent incident occurred in October 2026 involving a security breach at Binance, with a total impact amount of approximately $6.3 billion, of which around $3 billion has been frozen. ZachXBT assesses that this incident was likely carried out by North Korea's Lazarus Group.

Other major incidents include: the February 2025 Bybit incident valued at approximately $1.5 billion (attributed by the FBI), the March 2022 Ronin Bridge incident valued at approximately $620 million (attributed by the U.S. Department of the Treasury), and the September 2026 Bitget incident valued at approximately $387.5 million (attributed by Chainalysis).

Please note that the above total represents the sum of reported valuations for the 37 cases, including suspected attributions, without deducting frozen or recovered amounts; the $290 million associated with PlayDapp refers to nominal value from new issuance and does not equate to realized proceeds or final net losses. This compilation includes multiple groups linked to North Korea and is not an exhaustive list.