Between February 2025 and October 2026, attacks publicly tied to TraderTraitor, the North Korean unit inside Lazarus, took about $8.57B from crypto exchanges and bridges. Binance accounts for 74% of that sum. About 33% of the total is frozen, but almost all of it comes from one case.

Bybit, Feb 2025: $1.46B

A Safe{Wallet} developer's computer was hacked and malicious JavaScript was injected into the interface. Bybit's signers saw a normal-looking transaction and approved the drain of a cold wallet. About 3% was frozen. Within a month 86% of the ETH had been converted to BTC, most of it through THORChain. This is the only attack in the list with formal FBI attribution.

BtcTurk, Aug 2025: $48M

Hot wallets were breached, most likely through a stolen key. There is no data on frozen funds. Part of the stolen ETH later helped fund the Kelp attack.

Kelp DAO, Apr 2026: $292M

The attackers hacked two internal RPC nodes and DDoSed the external ones. The LayerZero bridge relied on a single verifier, which confirmed a fake burn. The Arbitrum Security Council froze about $71-75M (~25%). Around $220M has been laundered through THORChain, Wasabi, Tornado and Umbra.

AFX Trade, Jul 2026: $24.15M

A fake recruiter spent two weeks working with the team. A malicious git config gave the attackers the bridge validator keys. The stolen USDC became 12,467 ETH. Nothing has been recovered.

Bitget, Sep 2026: $387.5M

A zero-day in a third-party security product let the attackers forge withdrawal commands in the wallet system and wipe the logs. Every stablecoin was swapped within 41 minutes, so only $0.84M (0.2%) was frozen. $269M went through THORChain.

Binance, Oct 2026: $6.36B

A DevOps engineer's laptop led to a service container and then to signing access in the hot-wallet system across 10 chains. On Ethereum the attackers used 50 pre-signed EIP-7702 authorizations, after 36 hours of staging and test runs. About $2.7B (42%) is frozen: Tether ~$1.77B, Circle ~$825M, Ripple $40.5M, WLFI $27.8M, Arbitrum ~$30M. Roughly $2.4B in ETH and BTC is out of reach.

What the six have in common

• People, not code. None of the attacks used a smart contract bug. The way in was always a person or a piece of infrastructure.
• Stablecoins are the only thing that gets frozen. Binance's 42% exists because issuers caught about $2.66B in stables in time. Without Binance, about $117M of $2.21B was frozen, roughly 5%.
• THORChain is the exit. Loot from Bybit, Kelp, Bitget and Binance was moved to BTC through it.
• Weeks of preparation. Operator wallets funded through Tornado ahead of time, two weeks of social engineering at AFX, 36 hours of staging at Binance.

How solid is the link

Only Bybit has formal FBI attribution. The rest comes from analysts: TRM Labs, Elliptic and others. So far the link between the hacks rests on on-chain tracing: ZachXBT matched Binance and Bitget funds at one THORChain address. A shared laundering address points to one network, but it is not proof of one team.

Also linked: Phemex (~$85M, January 2025) sits just outside the window. MistTrack traced Binance funds to a wallet the Phemex hacker used before. With Phemex, the total is about $8.66B in 21 months.

Excluded: Drift ($285M, April 2026). TRM ties it to a different North Korean group.

Sums are at the time of each attack. Sources: TRM Labs, ZachXBT, Elliptic, BlockSec, MistTrack.