North Korean Hackers Launder Binance Theft at Rapid Pace
Written with artificial intelligence.
North Korean hackers have rapidly moved approximately $6.4 billion stolen from Binance, creating new crypto wallets every 25 seconds. So far, $2.85 billion of this amount has been frozen or seized, significantly more than in previous hacks.
Rapid Wallet Creation
According to an analysis by blockchain analytics firm Elliptic, North Korean hackers are swiftly dispersing the $6.4 billion stolen from Binance, establishing a new crypto wallet approximately every 25 seconds. In less than four days, the attackers have utilized around 12,000 wallets across 11 blockchains, executing over 40,000 transactions.
Freezes and Seizures
Of the total stolen amount, $2.85 billion, or 44%, has been frozen or seized by stablecoin issuers. This is a stark contrast to the roughly 3% recovery rate seen after North Korea's $1.5 billion hack of Bybit in February 2025. Stablecoins comprised a significant portion of the stolen funds, totaling $3.46 billion, allowing issuers like Tether and Circle to act swiftly. Tether froze stolen USDT within 37 minutes, and Circle managed to freeze all $823 million in USDC before it could be swapped.
Laundering Techniques
The attackers already converted $786 million in stablecoins before the freezes were enforced. They exchanged 434 million USDT for ETH and borrowed 19,762 ETH using Aave against 59.9 million USDT. Following the initial theft, Binance has resumed withdrawals, but users have reported net outflows reaching $3.64 billion within hours.
Ongoing Investigation
The FBI has linked the hack to TraderTraitor, a group associated with the North Korean government, and has published a list of connected addresses. Despite speculation about the use of AI for laundering, Elliptic suggests that the operations are automated but still resemble human decision-making patterns.
As of now, approximately $3.24 billion remains in addresses linked to the theft, primarily in ETH and 18,270 stolen Bitcoin, which have not moved since the attack. The remaining funds may have shifted to Chinese money-laundering networks, heightening concerns over crypto security amidst a series of high-profile hacks.