How North Korea is laundering the $6.4 billion stolen from Binance - Elliptic
North Korea is laundering $6.4 billion stolen from cryptocurrency exchange Binance through a complex, automated process using over 20,000 wallets across 16 blockchains.
The laundering operation is highly sophisticated and automated, utilizing more than 20,000 wallets across 16 blockchains, at least 36 services, and approximately 65,000 transactions. This amounts to roughly one new wallet every 30 seconds and one transaction every 10 seconds since the theft occurred on October 29, 2026.
As of November 6, 2026, about $3.11 billion remains in addresses linked to the theft, primarily held as Ethereum (ETH) and Bitcoin (BTC). Only a negligible amount has been successfully cashed out so far. The funds that haven't moved are very likely still under North Korean control, while those being laundered may have already been transferred to Chinese money laundering networks that North Korea has utilized in the past.
Asset Movement Patterns
The laundering process shows varying activity levels across different cryptocurrencies. Approximately $220 million in TRON (TRX) has been processed through the Tron network, with about $1 million remaining. Only small portions of Ethereum ($3 million of $1.33 billion) and NEAR ($0.9 million of $45 million) have been moved. About $50 million of the XRP has been swapped, mostly into Bitcoin, with approximately $226 million still remaining.
All of the stolen Solana (SOL), worth about $87 million at current prices, has been swapped, bridged, or mixed. Much of it has been converted to Bitcoin, contributing to the roughly 1,650 BTC ($124 million) now held from other stolen assets. Some batches have crossed four different blockchains within just a few hours.
Privacy Techniques
Some stolen funds have been mixed to obscure their origins. Since November 1, approximately 33 BTC ($2.5 million) has been processed through Wasabi-style coinjoins. Since November 3, about $1.1 million in ETH and SOL has been deposited into the Privacy Cash privacy pool, which temporarily paused deposits for about a day.
Based on the Bybit case, we expect the attacker to swap the ETH for bitcoin and then try to cash it out through OTC brokers and exchanges. We are already seeing the first step with the other stolen assets: about $124 million has been converted into bitcoin.
Theft Details
The $6.43 billion theft from Binance occurred between 20:05 and 23:56 UTC on October 29, 2026, affecting assets across 11 different blockchains. Binance has characterized the attack as a multi-stage campaign rather than a single breach. The operation began in June when an engineer installed a tampered copy of an AI coding tool, exposing the wallet team to attackers.
In September, attackers posing as recruiters conducted fake job interviews with another engineer, who downloaded a malicious 'assignment' onto his work computer. From there, they used an internal AI tool to access other engineers' machines and ultimately reached Binance's wallet signing service on October 29.
Related
