Lazarus Group Crypto Theft Estimates and BTC, BNB Market State: November 3, 2026

North Korea’s Lazarus Group has stolen about $11.87 billion in crypto, according to on-chain analyst Darkfost, as reported by Crypto Briefing on November 2, 2026. The outlet says the figure equals 45% of the country’s estimated 2025 GDP, based on Bank of Korea data, and 35% of its Gross National Income.

Crypto Briefing also cites blockchain intelligence firm TRM Labs, which puts total North Korean crypto theft higher, at around $12.8 billion across nearly 100 incidents dating back to 2017. The outlet notes the gap between the two estimates is about $930 million. TRM Labs also estimates that North Korean actors stole $7.4 billion in 2026 alone, which it says is 85% of all value stolen in crypto hacks globally during the year.

The report singles out an incident that reportedly hit Binance on October 29 and 30, 2026. Crypto Briefing says roughly $6.36 billion was extracted from compromised wallets across ten blockchains in about 20 minutes, and that the attack has been attributed to TraderTraitor, a state-sponsored unit linked to the Lazarus Group. It adds that Chainalysis had previously estimated cumulative North Korean crypto theft at more than $6.75 billion by the end of 2025.

What DAMO recorded

DAMO records market state only. The records below for BTCUSDT and BNBUSDT are as of 2026-11-02, around 19:13 UTC. They are shown next to the news, not as a response to it.

BTCUSDT. The shortest timeframes, 1m and 5m, are in recovery. That means the DAMO line is below zero and rising. The 15m, 1h, 4h and 1d timeframes are in bear momentum, with the line below zero and falling. The 12h timeframe is in recovery. The longer 3d and 1w timeframes are in weakening, with the line above zero and falling. The 1M timeframe is in recovery.

BNBUSDT. The picture is close to BTCUSDT’s. The 1m and 5m timeframes are in recovery. The 15m, 1h, 4h, 12h and 1d timeframes are all in bear momentum. The 3d and 1w timeframes are in weakening. The 1M timeframe is in bull momentum, which means the line is above zero and rising.

In plain terms, both assets show the same split. The very short timeframes are rising from below zero. The middle range, from 15m up to 1d, is mostly below zero and falling. The 3d and 1w timeframes are above zero but falling. The two records differ on only two timeframes. The 12h is in recovery for BTCUSDT and in bear momentum for BNBUSDT. The 1M is in recovery for BTCUSDT and in bull momentum for BNBUSDT.

Context

DAMO’s four states follow a fixed cycle: bull momentum, weakening, bear momentum, recovery, then back to bull momentum. A state describes the direction of the DAMO line relative to zero at a given timeframe. It does not explain why that direction occurred. The figures in the news story are estimates from the analysts and firms named by Crypto Briefing and may differ from one another, as the outlet itself notes. The DAMO records are a snapshot from a single moment on November 2.

Recorded states

Sources

• North Korea's Lazarus Group has stolen $11.87 billion in crypto, equal to 45% of the country's GDP — Crypto Briefing

About this data

States are DAMO VERIFIED records of closed candles (recorded as of BNBUSDT 2026-11-02 19:13 UTC, BTCUSDT 2026-11-02 19:13 UTC). They describe market state only and do not explain why it changed. Data and definitions: damolive.com/agents.

Market state data only. Not a trading signal. Not investment advice.

Disclosure: the operator of Emerge Times also operates DAMO.

This article was prepared with AI assistance and reviewed by an Emerge Times editor before publication. Licensed CC BY 4.0: credit “Emerge Times (emergetimes.com)”. Usage & License