Blockchain analysis attributes 76% of all cryptocurrency hack value through April 2026 to actors linked to North Korea. The cumulative figure across years is placed above $6.75 billion, with $2.02 billion in 2025 alone — a reported 51% year-on-year increase.
The concentration is the finding. A single state’s operators account for three quarters of the value taken across an entire global asset class, and reporting indicates a small number of incidents produced most of it.
Attribution Is Unusually Tractable Here
We normally treat attribution as the weakest link in a file. Cryptocurrency theft is the exception, because the evidence is a public ledger. Movement of funds can be traced continuously, laundering patterns recur across incidents, and clustering can be checked by anyone with the same data.
That is why we grade this high while grading most nation-state attribution medium. It is not that the analysts are better. It is that the substrate is observable in a way network telemetry never is.
The Theft Is The Programme, Not A Side Effect
United Nations panel reporting has linked proceeds attributed to DPRK operations to weapons procurement, with transaction analysis connecting funds to procurement networks. That reframes what these incidents are.
An exchange compromise in this category is not opportunistic crime that a government tolerates. It is a funding mechanism with performance expectations, which explains the persistence, the tolerance for long operations against individual targets, and the willingness to invest in social engineering campaigns that run for months.
For a defender the practical consequence is unwelcome: the adversary is not deterred by cost, is not seeking the easiest target, and does not stop when a particular route is closed.
Compiled from blockchain analysis reporting and public accounts, listed below. Figures are as published by the analysts; we have not independently reproduced their clustering. Where attribution is described as an assessment, we reproduce it as one. Corrections: corrections@forensicpost.com.