North Korean Hackers Move Stolen Binance Funds at Astonishing Speed
Overview of the Attack
In a remarkable cybersecurity breach, North Korean hackers have stolen approximately $6.4 billion from cryptocurrency exchange Binance. The transfer of these illicitly obtained assets is occurring at an unprecedented pace, with around one new crypto wallet being created every 25 seconds.
Distribution of Stolen Funds
According to blockchain analytics firm Elliptic, within just four days, the hackers have dispersed the stolen funds across approximately 12,000 wallets on 11 different blockchains, resulting in over 40,000 transactions.
Response from Stablecoin Issuers
In a swift counteraction, stablecoin issuers managed to freeze or seize nearly $2.85 billion, which constitutes 44% of the stolen funds. This decisive response is a stark contrast to a previous incident where only about 3% was reclaimed following the Bybit hack in February 2025.
Speedy Freezes Protecting Assets
The expediency of freezing assets proved crucial, particularly as stablecoins accounted for a significant portion ($3.46 billion, or 54%) of the total theft. Tether acted quickly, freezing USDT on the Ethereum blockchain just 37 minutes after it reached the hackers’ wallets. Similarly, Circle intervened before any of the $823 million in stolen USDC could be swapped.
Details of the Laundering Process
Prior to the asset freezes, the hackers had already exchanged 434 million USDT for Ethereum on decentralized exchanges like Uniswap. They also borrowed nearly 20,000 ETH through the Aave lending protocol against an additional 59.9 million USDT and traded 234 million USDT for Tron’s TRX token, making a total of about $786 million in stablecoins difficult to trace.
Aftermath and Investigation
The draining of Binance’s hot wallets commenced late Thursday, as the FBI later linked the attack to TraderTraitor, a hacking group associated with the North Korean regime. The agency has since disseminated information regarding hundreds of addresses tied to the breach.
Binance’s Financial Recovery Efforts
Following the incident, Binance has committed to covering all losses for affected users. They resumed withdrawals shortly after the attack, witnessing net outflows of approximately $3.64 billion within the first nine and a half hours.
Laundering Activities Persist
The laundering process has been extensive, particularly on the Tron network where activity surged to nearly 1,300 transactions in a single hour. Speculation arose that AI might be facilitating these operations; however, Elliptic dismissed this, attributing the high volume of transactions to pre-programmed activity rather than intelligent decision-making.
Remaining Stolen Assets
Currently, around $3.24 billion remains within wallets linked to the theft, primarily in ETH and 18,270 stolen Bitcoin, which have shown no signs of movement since the breach occurred. Elliptic suggests these funds may still be under North Korean control, whereas the funds that are being laundered might have shifted to networks involved in Chinese money laundering.
