Ledger All ledgers
Crypto hacks attributed to North Korea
12 crypto hacks that the FBI or the US government have publicly attributed to North Korea’s hackers, $9.34bn in total, each linked to the statement.
$9.34bn across 12 hacks the US has attributed to North Korea
That is 36.9% of the $25.31bn in known losses across all 1,200 incidents since 2019. The largest is Binance, at $6.36bn, followed by Bybit at $1.40bn.
Lazarus Group is the security industry’s name for a North Korean state hacking group. The US Treasury sanctioned it on 13 September 2019, saying North Korea’s government created it as early as 2007 and that it answers to the Reconnaissance General Bureau, the country’s main intelligence agency. The same action covered two related groups, Bluenoroff and Andariel. Source: US Treasury, 13 September 2019.
- Binance$6.36bn
- Bybit$1.40bn
- Ronin Bridge$624.0m
- DMM Bitcoin$305.0m
- WazirX: India$234.9m
- Atomic Wallet$100.0m
- Harmony Bridge$100.0m
- AlphaPo$60.0m
- Radiant V2$50.0m
- Upbit$49.3m
- CoinsPaid$37.3m
- Rain$14.8m
| Hack | Date | Lost | Attributed by | Statement |
|---|---|---|---|---|
| Binance | 29 Oct 2026 | $6.36bn | FBI | 31 Oct 2026 |
| Bybit | 21 Feb 2025 | $1.40bn | FBI | 26 Feb 2025 |
| Radiant V2 | 16 Oct 2024 | $50.0m | US and South Korea | 14 Jan 2025 |
| WazirX: India | 18 Jul 2024 | $234.9m | US and South Korea | 14 Jan 2025 |
| DMM Bitcoin | 31 May 2024 | $305.0m | FBI, DC3 and Japan's National Police Agency | 23 Dec 2024 |
| Rain | 29 Apr 2024 | $14.8m | US, Japan and South Korea | 14 Jan 2025 |
| AlphaPo | 26 Jul 2023 | $60.0m | FBI | 22 Aug 2023 |
| CoinsPaid | 22 Jul 2023 | $37.3m | FBI | 22 Aug 2023 |
| Atomic Wallet | 03 Jun 2023 | $100.0m | FBI | 22 Aug 2023 |
| Harmony Bridge | 23 Jun 2022 | $100.0m | FBI | 23 Jan 2023 |
| Ronin Bridge | 23 Mar 2022 | $624.0m | FBI | 14 Apr 2022 |
| Upbit | 27 Nov 2019 | $49.3m | US, Japan and South Korea | 14 Jan 2025 |
Only thefts named in an official statement count: FBI releases and alerts, and the January 2025 joint statement of the US, Japan and South Korea. The FBI names the hackers as Lazarus Group, APT38 or TraderTraitor depending on the statement. Security firms attribute many more thefts to North Korea, but those aren’t listed here. Amounts are the ledger’s, from DefiLlama, and can differ from the figure in a statement.
Addresses on the US sanctions list
The Treasury’s OFAC lists 131 crypto addresses under its North Korea sanctions programs, 8 of them under Lazarus Group itself. 61 belong to sanctioned individuals, who aren’t named on this site.
| Listed under | Addresses | Networks | Latest listing |
|---|---|---|---|
| Cheil Credit Bank | 53 | Tether | 04 Nov 2025 |
| Lazarus Group | 8 | Ethereum | Earlier |
| Amnokgang Technology Development Company | 7 | Ethereum, Tron | 12 Mar 2026 and earlier |
| Sinbad | 2 | Bitcoin | Earlier |
| Individuals (not named here) | 61 | Bitcoin, Ethereum, USD Coin, Tron | 28 Oct 2026 and earlier |
From the OFAC sanctions list, where the entry’s programs include North Korea (DPRK). Every sanctioned crypto address
Amounts are DefiLlama’s estimates and can change as incidents are revalued. Its returned figure can include money a company repaid itself, not only funds recovered from attackers. Source: DefiLlama.
Cite this Bitminer.io, “Crypto hacks attributed to North Korea”, data to 4 November 2026, https://bitminer.io/ledger/north-korea/. Free to reuse under CC BY 4.0 with credit and a link. How this is built