Lazarus Group Crypto Theft Hits $11.87B, 45% of North Korea GDP
In this article5 sections
An on-chain analyst known as Darkfost estimates that North Korea’s Lazarus Group has taken about $11.87 billion in crypto, a figure equal to 45% of the country’s estimated 2025 GDP on Bank of Korea data, Crypto Briefing reported on November 2, 2026. Measured against Gross National Income, the same sum equals 35%.
The estimate lands days after the FBI formally tied the largest single crypto theft on record to a North Korean unit inside Lazarus, adding an official attribution to a body of theft research that has mostly come from private analytics firms.
Key facts
- Darkfost’s estimate: roughly $11.87 billion in cumulative crypto theft, or 45% of estimated 2025 GDP and 35% of GNI.
- TRM Labs puts total North Korean theft higher, around $12.8 billion across nearly 100 incidents dating back to 2017.
- TRM Labs estimates North Korean actors stole $7.4 billion in 2026 alone, 85% of all value stolen in crypto hacks globally that year.
- The FBI attributed the October 29, 2026 Binance theft of about $6.3 billion to TraderTraitor, a Lazarus Group subunit, per CoinCentral.
- Binance covered losses with $6.34 billion of its own funds and planned a full proof of reserves by November 3, according to Blockonomi.
Two estimates, one direction
The $11.87 billion figure from Darkfost and the $12.8 billion count from TRM Labs differ by about $930 million, and Crypto Briefing notes the gap. Both dwarf the older baseline: Chainalysis had put cumulative North Korean crypto theft above $6.75 billion through the end of 2025. CertiK, cited by CoinCentral, offers a similar legacy tally of about $6.75 billion, though across 263 incidents between 2016 and early 2026.
The 2026 numbers account for most of the jump. TRM Labs’ $7.4 billion estimate for the year would mean the Binance incident alone makes up well over half of it. The Binance attack is also where the outlets diverge on size: Crypto Briefing describes about $6.36 billion extracted from compromised wallets across ten blockchains in roughly 20 minutes, CoinCentral cites about $6.3 billion with some reports at $6.4 billion, and Blockonomi writes of more than $6 billion.
What happens to the money
The FBI’s Saturday notice, quoted by both CoinCentral and Blockonomi, said TraderTraitor actors have mostly converted the stolen assets into Ether and are expected to move funds through DeFi tools and instant swap services. The agency listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address, and asked THORNode operators, RPC node operators, instant exchanges and analytics firms to block related transactions.
CoinCentral reports that stablecoin issuers have frozen more than $2.4 billion of the stolen funds. Chainalysis chief executive Jonathan Levin said the attackers have already used thousands of addresses and expects that to reach tens of thousands in the coming weeks.
Why it matters
For exchanges and their customers, the practical exposure is operational: affected platforms can face price volatility or thinner transaction volume as an incident becomes public, and tracing work by firms such as TRM Labs and Chainalysis increasingly determines how much stolen money can actually be spent. Binance said it would absorb all costs of the breach, with withdrawals re-enabled in phases from November 1 for BTC, ETH, USDT, USDC, BNB, XRP and Base-network assets.
The wider point is fiscal. CoinCentral notes the proceeds are used to help fund nuclear and ballistic missile programs, and CertiK’s analysis describes crypto theft as a core source of state revenue. Outside estimates cited by CoinCentral put North Korea’s yearly defense spending at up to $6 billion, a figure the outlet itself flags as uncertain.
What to watch
Binance’s full proof of reserves, planned for November 3 per Blockonomi, is the next hard checkpoint on whether its customer balances are fully covered. Levin’s projection that laundering addresses will multiply into the tens of thousands gives analysts a benchmark to test over the coming weeks.
Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.
Sources: Crypto Briefing, CoinCentral, Blockonomi
