Three of the largest cryptocurrency thefts of the past five years, the 2022 Ronin Bridge hack, the 2025 Bybit hack, and the October 2026 Binance breach, have all been linked by investigators or law enforcement to North Korea-backed hacking groups. The methods differ in detail, but the underlying pattern is strikingly consistent.
Three incidents, one pattern
| Incident | Date | Amount | How it happened | Attribution |
|---|---|---|---|---|
| Ronin Bridge / Axie Infinity | March 23, 2022 (discovered March 29) | ~$540M–$625M (173,600 ETH + $25.5M USDC, valuation method varies) | Attacker compromised 5 of 9 validator keys securing the bridge | US Treasury sanctioned the exploiter's wallet; Elliptic and Chainalysis both confirmed the match |
| Bybit | February 21, 2025 | ~$1.46 billion (401,347 ETH) | A routine cold-to-hot wallet transfer was silently redirected | Elliptic attributed it to Lazarus Group; FBI formally blamed North Korea ("TraderTraitor") on February 26, 2025 |
| Binance | October 29, 2026 | ~$6.34 billion across ~10 blockchains (Binance's figure) | Binance said a fraudulent job interview compromised an employee's computer, giving access to an internal service | FBI has blamed a North Korean group; North Korea has rejected the claim |
Sources: The Record, Ronin; TechCrunch, Ronin Treasury sanctions; The Record, Bybit; Daily Hodl, Elliptic on Bybit laundering; NBC News, Binance; Fox Business, Binance.
Scale, and what it represents
Chainalysis's 2026 report attributed roughly 59% of the $3.4 billion stolen in crypto hacks during 2025 to North Korea-linked groups, broadly consistent with the firm's earlier, separately reported figure of about $2 billion stolen by North Korean hackers that year, which itself included the Bybit breach. Read alongside the Ronin and Binance incidents, the pattern isn't a handful of isolated, opportunistic attacks; it's a sustained, repeated campaign against crypto infrastructure specifically, carried out by a state actor with the resources to maintain operational capability across years and multiple incidents, rather than a single group that gets lucky once.
It's rarely a blockchain flaw
None of these three incidents exploited a weakness in the underlying blockchain itself. The Ronin attacker compromised validator keys, effectively the small group of signatures needed to approve a withdrawal. The Bybit attacker intercepted a transfer process between a cold wallet and a hot wallet. Binance's own account of its breach describes a fraudulent job interview used to compromise an employee's device, which then provided access to an internal service, not a smart-contract bug. In each case, the target was the infrastructure and the people around the system, not the chain's own code.
Attribution comes from the money trail
Interestingly, the public confirmation of North Korean involvement in both the Ronin and Bybit cases came substantially from analysing how the stolen funds were laundered afterward, not just from the technical details of the breach itself. Elliptic said it attributed the Bybit theft to Lazarus Group "based on, among other things, our analysis of the laundering of the stolen cryptoassets," describing a swap into ETH as a pattern characteristic of the group. This is a direct, real-world example of the same method how tracing works describes: attribution built from a documented, sourced pattern in how funds move, not a guess.
How much ever comes back
Even with fast, confident attribution, recovery has been limited in each case. The FBI seized about $30 million of the roughly $600 million taken from Ronin, about 10%. Only around 3%, or $42 million, of the Bybit theft was ever frozen. The Binance case looks somewhat different on the surface, since Binance replenished the full amount from its own treasury and insurance funds and the DOJ said courts approved seizure or restraint of more than $1.2 billion, but it's worth being precise about what that means: Binance's reimbursement came from Binance's own funds, separate from whether the stolen crypto itself is recovered, and the DOJ's $1.2 billion figure is a court-approved seizure or restraint action, not a confirmation that the funds have been returned to anyone. Inside the Binance hack covers that distinction in detail.
The laundering playbook, once funds are stolen
Attribution in these cases has repeatedly come from watching what happens after the theft, not just the breach itself. Elliptic described the Bybit laundering as following a pattern characteristic of Lazarus Group: stolen tokens were swapped into ETH, an asset that's harder for any single central authority to freeze or block compared with a token like USDT, which an issuer can blacklist. From there, funds typically move through a sequence of mixers, cross-chain bridges and swaps, deliberately echoing the same kind of multi-hop movement described in why cross-chain bridges break traces, executed at a speed and scale that outpaces most individual fraud cases.
This is also why the laundering pattern itself becomes part of the evidence. A trace that shows funds swapped into ETH within minutes of a breach, then routed through a sequence of addresses and bridges matching previously documented Lazarus Group activity, is doing the same work as any other attribution: building a sourced, documented link between unknown addresses and a known actor, based on behaviour rather than a name on an account.
What a sanctions designation actually does
The Treasury's April 2022 sanctioning of the wallet address linked to the Ronin theft is a useful example of a tool distinct from a freeze or a seizure. Sanctioning an address makes it illegal for US persons and, in practice, most regulated exchanges worldwide, to knowingly transact with it, which raises the cost and difficulty of cashing out funds that pass through it, without directly seizing anything. It's a slower, broader pressure rather than an immediate block, and it depends on exchanges and other regulated entities actually screening against the sanctions list, which is part of why wallet screening against known-flagged addresses matters even for activity that has nothing to do with an individual fraud report.
Why exchanges and bridges are the target
Individual wallets rarely hold enough value to justify this level of sophistication. Exchanges and bridges concentrate large amounts of value in a comparatively small number of wallets, validator sets or smart contracts, which makes a single successful compromise disproportionately valuable compared to the effort involved. For exchange compliance teams, this is part of why monitoring deposit addresses and large, unusual withdrawal patterns matters as much as securing the platform's own infrastructure.
What this means beyond major exchanges
It's tempting to read these three incidents as a story about exchange and bridge security specifically, and largely they are. But the methods, employee-targeted social engineering, fast laundering through swaps and bridges, and attribution built from watching fund movement rather than the breach itself, aren't exclusive to state-backed actors or billion-dollar targets. The same fundamental pattern, compromise the people or process around a system rather than the cryptography itself, then move stolen funds quickly through a documented but fast-moving path, shows up at smaller scale in ordinary fraud cases our investigators work too. How tracing works describes the same method applied there.
For exchange compliance teams, the practical lesson from all three incidents isn't really about validator counts or employee vetting policy specifically; it's that monitoring unusual, large or rapid deposit activity, especially swaps into ETH or movement through known mixer and bridge services, remains valuable even when the initial breach happens somewhere else entirely. For exchange compliance teams covers how that monitoring connects to acting on a freeze request once funds are identified.
What this means for the Binance case specifically
Set against this history, the open question for the Binance incident isn't really whether North Korean involvement is plausible. The pattern of targeting major exchange infrastructure fits a documented, years-long campaign. The open question is whether the specific attribution holds up the way it did for Ronin and Bybit, where independent analytics firms published their own on-chain reasoning rather than relying on a government statement alone. That kind of independent verification hadn't yet appeared in available reporting on Binance at the time of writing, which is exactly the caveat inside the Binance hack treats carefully rather than assuming is already settled.
Key takeaways
- Three of the largest crypto thefts on record, Ronin, Bybit and Binance, have each been linked to North Korea-backed groups.
- In each case, the attacker compromised infrastructure or people, not the blockchain itself.
- Attribution has repeatedly come from analysing how stolen funds were laundered, the same method used in ordinary fraud tracing.
- Laundering after these thefts typically follows a fast, multi-hop path through swaps, mixers and bridges.
- Even with fast attribution, only a small fraction of stolen funds has typically been frozen or seized.