North Korea-linked hacking groups are suspected of stealing approximately $12.8 billion in cryptocurrencies since 2017, according to findings attributed to blockchain intelligence firm TRM Labs. Nearly 100 cyberattacks over less than a decade have reportedly targeted the global digital asset ecosystem. A massive alleged breach of Binance on October 29, 2026, involving an estimated $6.36 billion, has brought renewed attention to the growing intersection of cybercrime, international finance and geopolitical security.

The global financial system is facing a new generation of cyber threats capable of causing multibillion-dollar losses within minutes. According to figures attributed to TRM Labs, hacking groups associated with North Korea have allegedly stolen digital assets worth approximately $12.8 billion since 2017 through nearly 100 operations.

The year 2026 has reportedly marked an unprecedented escalation. The groups are suspected of stealing $7.4 billion since January, accounting for approximately 85% of the total value of cryptocurrencies stolen worldwide during the period.

Binance and the Alleged $6.36 Billion Cyber Heist

The reported attack against Binance on October 29, 2026, represents the most significant incident in this series. Approximately $6.36 billion in digital assets was allegedly transferred from wallets associated with the exchange in around twenty minutes, across ten blockchain networks.

If confirmed, the scale of the incident would far exceed the February 2025 Bybit breach, which resulted in losses estimated at approximately $1.5 billion.

Investigators have linked the alleged Binance attack to TraderTraitor, a hacking group associated by cybersecurity researchers with North Korean state-backed operations.

According to accounts attributed to Binance, the attackers reportedly spent months preparing their intrusion, using compromised development tools, fraudulent recruitment opportunities and malicious software to gain access to sensitive systems.

The exchange reportedly announced additional security measures and compensation arrangements for affected customers. North Korea has denied allegations of involvement in such cyber operations.

Five Major Attacks Account for $9.1 Billion

The alleged Binance breach forms part of a wider series of cyberattacks targeting cryptocurrency exchanges and digital asset infrastructure.

According to the reported TRM Labs figures, five major incidents involving Binance, Bybit, Ronin, Bitget and DMM Bitcoin account for approximately $9.1 billion in losses.

These operations illustrate a significant shift in cybercriminal strategies. Rather than focusing on numerous smaller attacks, sophisticated hacking groups increasingly target infrastructure capable of providing access to vast amounts of capital.

Cryptocurrency exchanges, custody services and transaction authorisation systems have consequently become particularly attractive targets.

Human Infiltration Becomes a Major Cybersecurity Threat

Modern financial cyberattacks no longer rely exclusively on technical vulnerabilities. Increasingly, they exploit employees, developers and other individuals with privileged access to sensitive systems.

Common methods include fraudulent job offers, fake recruitment interviews, malicious technical assessments and compromised software tools.

Once attackers gain access to an organisation’s internal environment, they may attempt to obtain credentials, digital keys and transaction approval permissions.

According to the figures attributed to TRM Labs, attacks against critical infrastructure account for approximately 88% of the value of cryptocurrencies allegedly stolen by North Korea-linked groups since 2017, including the reported Binance incident.

This trend highlights a fundamental cybersecurity challenge: protecting digital financial systems requires safeguarding both technological infrastructure and the people operating it.

A Global Race to Recover Stolen Assets

Following the alleged Binance breach, blockchain analytics firms, cryptocurrency platforms and stablecoin issuers reportedly coordinated efforts to identify and freeze stolen funds.

Initial estimates attributed to TRM Labs indicated that approximately $2.7 billion had been frozen, while Chainalysis reportedly placed the amount closer to $2.8 billion.

However, attackers were believed to retain approximately $2.4 billion in Bitcoin and Ether, assets that cannot be directly frozen by a central issuer.

The situation illustrates the challenges regulators face when attempting to recover digital assets transferred rapidly across multiple blockchain networks.

Cybercrime as a Potential Instrument of State Financing

Beyond financial losses, the allegations raise a major geopolitical question: whether cybercrime is being used to generate foreign currency for a state subject to extensive international sanctions.

For several years, US authorities and international experts have linked North Korean hacking networks to cryptocurrency thefts and suspected attempts to circumvent financial restrictions.

Some investigations suggest that proceeds from these operations may help finance strategic activities, potentially including military and weapons programmes.

Pyongyang disputes these allegations. Nevertheless, the cases illustrate how cybercrime can become intertwined with national security, sanctions enforcement and international financial stability.

Africa Faces Growing Digital Financial Risks

For African economies experiencing rapid growth in digital payments, financial technology and online banking, these developments carry important lessons. The expansion of digital financial services creates significant opportunities for financial inclusion and economic growth, but also increases exposure to sophisticated cyber threats. Banks, payment institutions, fintech companies and digital infrastructure operators must therefore treat cybersecurity as a strategic priority.

In Morocco and other African economies undergoing digital transformation, stronger data protection, transaction monitoring, identity verification and infrastructure security are increasingly essential. The methods used against cryptocurrency platforms can also threaten traditional financial institutions, industrial companies and operators of critical infrastructure.

Cybersecurity Becomes a Question of Economic Sovereignty

The reported scale of cryptocurrency theft linked to North Korean hacking groups demonstrates how profoundly financial crime has changed. Digital assets enable rapid international transfers, while sophisticated cyberattacks can potentially produce losses comparable to those associated with major financial crises. Addressing these risks requires cooperation between financial regulators, law enforcement agencies, cybersecurity companies and digital asset platforms.

With approximately $12.8 billion in cryptocurrency thefts attributed to North Korea-linked groups since 2017, cybercrime has entered a new era of scale and geopolitical significance. The alleged Binance incident underscores a critical reality: protecting digital infrastructure is no longer merely a technical responsibility. It has become an essential pillar of financial stability, investment security and economic sovereignty.