How Hackers Took $7.61 Billion in 2026 Without Breaking Code

Human Credentials Over Smart Contract Bugs

Major crypto security incidents often make people think of complex software flaws. However, recent data from blockchain intelligence firm BitOK reveals a very different tactic used in 2026.

Between January and October 2026, North Korean hackers took an estimated $7.61 billion across 38 separate incidents. Crucially, they did not exploit smart contract code in any of the primary attacks.

Instead of hunting for programming errors, the attackers compromised the people, devices, and signing services that authorize withdrawals.

Breaking Down the $7.61 Billion Total

Security teams and law enforcement managed to freeze and seize $2.86 billion of the targeted funds. However, $4.75 billion remains unrecoverable.

The vast majority of the stolen funds originated from a single high-profile breach, though smaller targets were affected as well:

• Binance breach: Accounted for $6.41 billion of the total stolen assets.
• Smaller incidents: 32 individual thefts targeting smaller firms and users added up to $178.4 million.
• Six major attacks: Focused entirely on obtaining valid authorization signatures rather than exploiting smart contracts.

Why Smart Contract Audits Did Not Prevent the Exploits

In each of the six major attacks, the withdrawal transactions appeared completely legitimate to the network because they carried valid digital signatures.

BitOK's report highlights how attackers gained entry across different platforms:

• Binance: Attackers compromised a DevOps engineer's laptop and a signing-service container.
• Drift: Hackers compromised multisig signers on the SolanaSOL-5.16%-based trading platform.
• KelpDAO: Attackers gained control of a single bridge verifier.
• Bitget: The threat actors breached the internal wallet system.

Before carrying out each theft, the operators tested their withdrawal routes using small test transactions. For example, the contract involved in the Binance exploit ran publicly four hours prior to the main transfer.

Attackers Maintained Standard Office Hours

The analysis of the hackers' activities revealed an organized, structured work routine during the preparation phase.

Out of 540 transactions analyzed by BitOK, 48% took place between 4 p.m. and 9 p.m. Pyongyang time.

The group also observed North Korean public holidays, recording no transaction activity on those dates. Saturdays, Sundays, and Mondays combined accounted for only 10% of total activity.

However, once an attack launched, the team switched to automated scripts that moved funds continuously around the clock.

Speed, Swapping, and Laundering Tactics

The ability to freeze stolen assets depends heavily on response time. Because central issuers cannot freeze EthereumETH-6.03%, the attackers immediately swapped stablecoins for ETH or used them as collateral to borrow ETH.

Following the April rsETH bridge exploit, the first 52,440 ETH was moved out of lending protocols in just over eight minutes.

The stolen funds then remained stationary for 2.5 to 5 days before automated scripts routed them through THORChain, a cross-chain swap protocol.

Laundering fees turned out to be relatively low. Across 2,257 Binance-related swaps valued at $55.8 million, total transaction costs averaged just 0.50%.

The Effectiveness of Asset Freezes

Asset freezes were primarily successful when centralized stablecoins had not yet been transferred out of their initial addresses.

At Binance, swift intervention enabled security teams to freeze or seize 43% of the affected funds. Across all other major attacks combined, only 6% was successfully frozen.

Delay was a major factor. TetherUSDT+0.24% received its initial freeze request 34 minutes after the Binance withdrawal began. By that time, 345 million USDT had already left the original wallet address.

A Small Residual Balance Links Five Attacks

Despite complex laundering routes, a minor operational error created an on-chain connection between multiple incidents.

After routing 5,047 ETH through the privacy tool Umbra and the Stargate bridge, the operator consolidated remaining small balances into a single wallet address.

On August 31, 150 separate addresses transferred their remaining dust into this collector wallet within 3 minutes and 36 seconds.

Tiny residual balances became the operator's clearest trail of the year.

This consolidation connected the AFX breach, an August 28 incident, and subsequent Bitget wallet withdrawals in September. In total, the wallet received only 0.27 ETH, but it linked five major attacks from KelpDAO in April to Binance in October to one laundering operator.

Shifting Focus in Blockchain Security

While Chainalysis had previously linked the Bitget incident to North Korean groups in October, BitOK's findings demonstrate a repeated pattern of targeting administrative access rather than smart contract code.

As security practices evolve, protecting internal signing keys, employee endpoints, and authentication infrastructure has become as critical as auditing smart contracts.

Following the breach, Binance covered affected customer losses using its internal reserves. As a reminder, past security performance or operational records of platforms and assets do not guarantee future performance.