Statistics: North Korea-linked hackers involved in 37 crypto theft cases over 9 years, with a cumulative total exceeding $11.8 billion

TechFlow reported on October 30 that, according to TechFlow's statistics, hackers linked to Lazarus and North Korea were involved in 37 crypto theft cases between 2017 and 2026, with reported valuations totaling approximately $11.817 billion.

The most recent case is the October 2026 Binance security incident, with a total impact of approximately $6.3 billion; about $3 billion has been frozen. ZachXBT assessed that the incident was likely carried out by North Korea's Lazarus Group.

Other high-value cases include the February 2025 Bybit incident of approximately $1.5 billion (attributed to the FBI), the March 2022 Ronin Bridge incident of approximately $620 million (attributed to the U.S. Treasury), and the September 2026 Bitget incident of approximately $387.5 million (attributed to Chainalysis).

It should be noted that the above total is the sum of reported valuations for the 37 cases, includes cases with suspected attribution, and does not deduct frozen or recovered amounts; the $290 million for PlayDapp represents the nominal value of the additional issuance, not monetization proceeds or final net loss. This statistic covers multiple North Korea-linked groups and is not an exhaustive list.

Source: TechFlow