North Korea Is Laundering Binance Hack Loot at One New Wallet Every 25 Seconds
North Korean hackers are moving $6.4 billion stolen from Binance at a blistering clip, creating roughly one new crypto wallet every 25 seconds.
In under four days, the attacker has spread the funds across about 12,000 wallets on 11 blockchains in more than 40,000 transactions, according to an analysis published Monday by blockchain analytics firm Elliptic. The FBI has attributed the theft to TraderTraitor, a North Korean state-linked hacking group.
About $2.85 billion, or 44% of the haul, has been frozen or seized, compared with roughly 3% after North Korea's $1.5 billion hack of Bybit in February 2025. Stablecoin issuers moved quickly to freeze the funds.
Stablecoin Freezes
Stablecoins made up $3.46 billion, or 54%, of the haul, and their issuers can freeze them. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet, and Circle froze all $823 million in stolen USDC before any of it could be swapped.
Before the freezes landed, the hacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on lending protocol Aave against another 59.9 million USDT, and traded 234 million USDT for Tron's TRX token.
Laundering Tactics
The laundering has been relentless, with activity on Tron peaking at about 1,300 transactions in a single hour. This pace fueled speculation that AI agents were doing the work, but Elliptic disagreed.
Elliptic pointed to fixed timing, set amounts, blind retries and pauses that resemble human working hours. The firm wrote that while the laundering is clearly automated, 'nothing we have seen shows an AI agent making decisions.'
Remaining Funds
About $3.24 billion remains in addresses linked to the theft, mostly ETH and the 18,270 stolen Bitcoin, which haven't moved since the day of the attack. Elliptic believes those funds are very likely still held by North Korea.
Based on the Bybit playbook, Elliptic expects the attacker to swap its ETH for Bitcoin in small batches and cash out through over-the-counter brokers over a period of months. Further freezes will be harder since ETH and Bitcoin can't be frozen.
Related
