Blockchain intelligence analysts are recording an unprecedented concentration of threats in the crypto industry: groups presumably linked to North Korea account for nearly 89% of all recorded losses from cryptocurrency theft in 2026. This is a record level of dominance by a single category of malicious actors in the entire history of observations.
Particular concern is caused not only by the share but also by a qualitative shift in attack tactics. The average damage from a single incident rose from $50.65 million to $185.65 million — an increase of more than 3.6 times. In other words, North Korean operatives have moved from mass small-scale thefts to targeted strikes on large infrastructure targets with maximum one-time effect.
Accumulated damage is measured in billions
For the period from 2021 through October 29, 2026, North Korean groups are attributed with thefts totaling $13.24 billion, which amounts to 59% of all industry losses over this time span. Among the most high-profile episodes is the hack of the largest crypto exchange Binance, which became one of the symbols of the systemic vulnerability of centralized platforms.
Such statistics indicate that cybercrime has turned into a full-fledged source of state financing: stolen assets pass through complex mixing and money-laundering chains, which significantly complicates their tracking and recovery.
For market participants, this is a signal of the need to revise risk management models. Large custodial services, exchanges, and DeFi protocols are becoming priority targets, while the gap between infrastructure protection and the sophistication of attackers continues to grow.
Cryptalist analysis: The concentration of almost 90% of losses on a single group of malicious actors reflects the structural asymmetry of the crypto market, where state-sponsored actors possess resources incomparable to the capabilities of most private platforms. The threefold increase in average damage per attack indicates a shift toward a "large targets" strategy, which increases pressure on institutional investors and raises the importance of insurance and audit mechanisms in the valuation of crypto assets.