North Korea-linked actors accounted for roughly 95% of the losses in Security Alliance's Q3 2026 assessment, with publicly tracked DPRK-attributed theft exceeding $1 billion for the year. TraderTraitor/UNC4899 was publicly attributed with the Bitget and AFX Trade thefts, which relied on compromised trusted infrastructure rather than direct private-key theft. DPRK-linked operations also used fake recruitment, malicious developer projects, supply-chain compromises, fake meeting infrastructure, and long-dormant access to reach cryptocurrency organizations. The report additionally highlights the continued adaptation of the DPRK IT-worker scheme and the use of stolen funds to support further operations.