North Korea Launders Binance Hack Proceeds Through Thousands of Wallets and Memecoins
Blockchain analytics firm Elliptic says North Korean hackers have spread stolen Binance funds across roughly 12,000 wallets on 11 blockchains in under four days. About $2.85 billion has been frozen or seized, largely because stablecoin issuers acted quickly, while sources differ on the size of the theft.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Scale and Speed of the Laundering
North Korean hackers have moved funds from the Binance theft at a rapid pace, creating roughly one new crypto wallet every 25 seconds, according to Elliptic. Decrypt reported that the attacker spread the proceeds across about 12,000 wallets on 11 blockchains in more than 40,000 transactions within under four days.
The size of the theft is reported differently across sources. Decrypt, citing Elliptic, put the amount at $6.4 billion, while CoinDesk, also citing Elliptic, reported $6.3 billion. The discrepancy has not been explained in the coverage reviewed here.
Stablecoin Freezes Limited the Losses
Stablecoin issuers moved faster than the thief. Decrypt reports that about $2.85 billion, or 44% of the haul, has been frozen or seized. Stablecoins made up $3.46 billion, or 54%, of the stolen funds. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet, and Circle froze all $823 million in stolen USDC before it could be swapped, per Elliptic's findings.
Before the freezes took effect, the hacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on Aave against 59.9 million USDT, and traded 234 million USDT for TRX. Decrypt estimates about $786 million in stablecoins got away.
Tactics and Attribution
The FBI has attributed the theft to TraderTraitor, a North Korean state-linked hacking group, and has published hundreds of linked addresses. Decrypt reports that the attackers began draining Binance hot wallets late Thursday.
CoinDesk, citing Elliptic, reports that the group used six homemade memecoins to launder 117,000 NEAR, worth about $430,000, from the theft. Decrypt reports that on Tron, which became the main laundering route, activity peaked at about 1,300 transactions in a single hour.
The pace led some to speculate that AI agents were running the operation. Elliptic disagreed, citing fixed timing, set amounts, blind retries and pauses resembling human working hours. The firm said the laundering is clearly automated, but "nothing we have seen shows an AI agent making decisions."
Remaining Funds and Outlook
Decrypt reports that about $3.24 billion remains in addresses linked to the theft, mostly ETH and 18,270 stolen Bitcoin that have not moved since the attack. Elliptic believes those funds are very likely still held by North Korea, while funds already being laundered may have passed to Chinese money-laundering networks. About $16 million has also flowed to addresses holding proceeds of September's Bitget exploit.
Elliptic expects the attacker to convert ETH to Bitcoin in small batches and cash out through over-the-counter brokers over several months. Further freezes will be harder because ETH and Bitcoin cannot be frozen, so the firm sees the best remaining opportunities with centralized services where funds will eventually surface.
Binance has pledged to cover all losses and reopened withdrawals Sunday. Decrypt reports about $3.64 billion in net outflows in the first nine and a half hours after reopening. Separately, BTCPay Server urged merchants to switch off their servers amid reports of hot wallet attacks, and Brazilian exchange Mercado Bitcoin halted withdrawals after a $40 million hack. Decrypt notes it is unclear whether either incident is connected to the Binance attack.
Why It Matters
For Traders
Binance outflows and possible ETH-to-Bitcoin conversions by the attacker could add volatility, but freezes and reported held funds make the path of remaining proceeds uncertain.
For Investors
Stablecoin issuers freezing about 44% of the proceeds signals that centralized issuers can materially limit losses from large exploits, a factor in assessing counterparty risk.
For Builders
Attackers used DEX swaps and Aave borrowing before freezes, so protocols should review how they handle large stablecoin flows and collateral borrowing during active exploits.
This article is for information only and is not financial advice. Read the full disclaimer.
