TRM estimates that North Korea-backed hackers have stolen USD 12.8 billion in cryptocurrency since 2017, including USD 7.4 billion in 2026. It attributes the October 29 Binance theft of approximately USD 6.36 billion to the North Korean state-sponsored TraderTraitor unit with high confidence, although no government had publicly attributed the incident and Binance had not disclosed its root cause. TRM says North Korean operations primarily compromise people, credentials, and transaction-signing infrastructure rather than smart contracts, then launder proceeds through fresh wallets, cross-chain services, mixers, and brokers. Nearly USD 2.7 billion from the Binance theft was frozen, while approximately USD 2.4 billion remained in BTC and ETH beyond issuer-controlled freezing.