TRM Estimates North Korea-Linked Crypto Theft at $7.4 Billion

TRM Labs estimates North Korea-linked actors stole $7.4 billion in crypto through Oct. 29, with the $6.36 billion Binance theft driving most of the total.

Global crypto hacking losses reached $8.7 billion through Oct. 29, putting North Korea-linked thefts at 85% of the total. Without the Binance incident, that share falls to 45%, showing how heavily one theft shapes the annual comparison.

TRM attributes the Oct. 29 Binance breach to TraderTraitor, a North Korea-linked group, with high confidence. About $6.36 billion left Binance wallets across 10 blockchains; most transfers occurred within about 20 minutes starting at 4:05 p.m. ET (20:05 UTC). Binance has not published a root cause.

TRM says the attacker used 50 pre-signed Ethereum authorizations and likely gained access to Binance’s hot-wallet signing system. Separately, TRM describes North Korea-linked crews using fake recruiter or investor approaches to deliver malware disguised as coding tests, but does not identify that as the Binance entry route.

The $7.4 billion tally also includes the Bitget theft, which TRM has not definitively attributed to North Korea; it says another actor remains possible.