North Korea-linked hacking operations have reached another alarming milestone following the massive $6.3 billion Binance security breach.
According to on-chain analyst Darkfost (@Darkfost_Coc), the cumulative value of cryptocurrency stolen by the Lazarus Group has reached approximately $11.87 billion.
The figure is equivalent to roughly 45% of North Korea’s 2025 GDP and 35% of its gross national income, based on figures from the Bank of Korea.
Binance hack becomes the group’s biggest reported operation
The October 29 Binance incident accounts for approximately $6.36 billion of the estimated total, making it the largest single crypto theft attributed to the North Korean hacking operation.
Blockchain intelligence firm TRM Labs traced the stolen assets across 10 blockchains and attributed the attack to North Korea’s TraderTraitor hacking unit with high confidence.
FBI officially confirms North Korean involvement
On October 31, the FBI officially confirmed that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance.
The agency identified the operation as TraderTraitor and warned that the attackers were converting stolen assets primarily into Ethereum before further laundering through decentralized finance platforms and instant swap services.
The FBI is working with the U.S. Secret Service and IRS Criminal Investigation to track the stolen funds and urged crypto platforms and blockchain service providers to block transactions connected to the identified addresses.
Not all stolen funds reach North Korea
Darkfost also highlighted an important distinction: some of the stolen assets were lost during laundering attempts. Therefore, the $11.87 billion represents estimated cumulative theft, not money confirmed to have reached or remained under North Korean government control.
The bigger picture
The Binance incident has once again raised serious questions about cryptocurrency security, exchange infrastructure and the growing threat of state-linked cybercrime.
With billions of dollars involved, the investigation and asset-tracing efforts remain critical for the wider crypto industry.
One question remains: How many more billions could be stolen before the industry strengthens its security?