On‑chain analyst Darkfost estimates that the Lazarus Group has stolen approximately $11.87 billion in cryptocurrency. Using Bank of Korea projections, that amount represents about 45% of North Korea’s estimated gross domestic product for 2025 and 35% of its gross national income.
Blockchain intelligence firm TRM Labs reports a slightly higher total of $12.8 billion, based on nearly 100 incidents dating back to 2017. The two estimates differ by roughly $930 million.
Recent Activity
TRM Labs says North Korean actors stole $7.4 billion in 2026, accounting for 85% of the global value taken in cryptocurrency hacks that year.
The largest single incident attributed to the group occurred on October 29‑30, 2026, when compromised Binance wallets across ten blockchains were drained of about $6.36 billion in roughly 20 minutes. The operation is linked to a unit known as TraderTraitor, which is associated with the Lazarus Group.
Historical Context
Chainalysis previously estimated cumulative North Korean crypto theft at $6.75 billion by the end of 2025. The newer figures from Darkfost and TRM Labs suggest the total has nearly doubled, driven largely by the 2026 activity and the Binance breach.
Implications
The scale of these thefts highlights potential volatility for cryptocurrency exchanges and underscores the geopolitical dimension of digital‑asset crime, as the stolen value approaches a significant share of the sanctioned nation’s economy.
