Chainalysis

🚨 PSA: We continue to receive reports of third parties impersonating Chainalysis on various platforms. These scammers often use similar tactics and offer everything from help recovering lost funds to fake jobs usually in exchange for information or a fee. Our team works hard to detect and take these scams and impersonations down as soon as they are discovered, however if you get any of these messages, or believe you may be the victim of a scam, contact local law enforcement. You can also let us know via [email protected] so we can continue to track and manage these scams proactively. 𝐖𝐞 𝐰𝐢𝐥𝐥 𝐍𝐄𝐕𝐄𝐑 𝐫𝐞𝐚𝐜𝐡 𝐨𝐮𝐭 𝐭𝐨 𝐲𝐨𝐮 𝐅𝐈𝐑𝐒𝐓. We also won’t: 💰Ask you for funds 💸Promise you recovery of lost funds from scams or hacks 📋Offer you a job in exchange for any type of “fee” 💻Ask you to provide your information via a link on text, messaging services or unverified email 📵Send you unsolicited phone calls, emails, WhatsApp, Signal, Telegram or text/SMS 🔗Reminder: Chainalysis primarily provides its products and services to public and private sector businesses, and does not engage in investigation assistance for individual victims We have more tips you can use to verify if the contact is legitimate on our website: chainalysis.com/scams

Our Co-founder and CEO @jony_levin spoke with @BBCNews today on the Binance exploit.

Suspected North Korea-linked hacks account for nearly 89% of reported crypto hack losses so far this year. In 2021, that share was 15%. The average reported loss per suspected DPRK-linked hack rose from $50.65M in 2021 to $185.65M in 2026 YTD, about 3.7x larger. From 2021 through October 29, 2026,  suspected DPRK-linked hacks account for $13.24B of the $22.34B in reported losses, about 59%.

Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: chainalysis.com/blog/binance…

Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance. We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.

~$3B frozen thanks to transparent technology + industry-wide coordination. Our investigators are actively identifying additional opportunities to disrupt.

Our current estimate on amount stolen is approx $5.912B at time of theft, nearly 4x the amount stolen in the next largest crypto heist (Bybit, 2025)

We are actively investigating the potential exploit of Binance in coordination with industry partners. At present we are monitoring funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron, and a number of L2s, and will support Binance throughout this investigation.

Our research into the ring finds it provided a cash-out for undercover workers who were themselves embedded in crypto development companies. In these schemes, state-sponsored North Korean agents secretly seek employment in legitimate businesses, earn income and pass that income along to fund the regime. The operations now span dozens of countries and generate an estimated $250 to $600 million in annual revenue for the DPRK, according to the United Nations Panel of Experts. This action targets the financial side of that pipeline, the individuals and entities that convert the workers' crypto earnings into usable funds for Pyongyang. Two Russian nationals converted millions of dollars for front companies that provided cover for DPRK IT workers, and our research finds their relationships to these networks stretch back years. Two DPRK nationals directly managed IT workers based in Russia. The reactor image below shows one link in that chain. On the left is a DPRK IT worker who built code for blockchains and DeFi protocols, according to our research. The worker's wallet received bi-weekly stablecoin transfers for months, from late 2022 to early 2023, a transaction history that resembles a salaried worker's. It converted the stablecoins to ETH and passed them to consolidation addresses we track as sanctioned entities. From there the funds flowed to one of the sanctioned Russian nationals, who sent the crypto to exchanges for cashout. One of the two Russian nationals was also sanctioned for serving as an intermediary for illicit DPRK financial transactions, including those involving Amnokgang, which was designated in March for managing DPRK IT worker delegations. His wallet received funds from Amnokgang and made deposits into accounts at both mainstream and sanctioned exchanges. OFAC alleges he converted nearly $2 million in cryptocurrency into fiat for DPRK officials. More broadly, DPRK operatives have been observed using generative AI to fabricate resumes, and in some cases AI-generated photos and deepfake video on hiring calls, making detection more difficult for employers who rely on interviews and document review. This use of AI is a major development.

Congratulations to the FASE Foundation on their launch, we are proud to be a founding partner.

Chainalysis is proud to assist the DOJ's Scam Center Strike Force in its action against global crypto investment fraud, including an alleged Madagascar scam operation that used fake NFT investments to steal from Americans. This reactor chart shows how one victim of the alleged scam lost over $30,000. Prosecutors say the victim was duped into thinking that inftvault.com (which has been seized) was a legitimate NFT investment site. The victim signed a transaction that allowed the allegedly fraudulent website to drain their wallets. The alleged scammers then sent the stolen funds to crypto exchanges for cashout.

The UAE's crypto economy grew 32% to $104.8 billion. The Iran war brought regional conflict and slowed the Emirates' broader economic growth, but its crypto economy kept growing. With the UAE, MENA contracted 1.4%. Without it, the rest of MENA contracted 8.6%. This didn't happen overnight. The UAE spent years courting crypto business and leading on crypto regulation. It has paid off: institutional capital looking for a durable regulated hub has concentrated there. Other jurisdictions will be studying this for years. @HenriArslanian of Nine Blocks Capital Management calls the UAE "an example of how to grab an opportunity."

UPDATE: Over $1.8 million of crypto tied to this weekend's attack on X100 was sent into a mixing service a few hours ago.