North Korean hackers begin second laundering phase for Binance loot, start bitcoin mixing

North Korean hackers spread the crypto stolen from Binance across about 12,000 wallets in under four days, blockchain analytics firm Elliptic said in a report on Nov. 2. The attacker made more than 40,000 transactions across 11 blockchains, and after distributions on Tron stopped on Nov. 1, assets on other chains, including Solana, Ethereum and XRP, began to move, Elliptic said. That works out to roughly one new wallet every 25 seconds.

1,113 transfers over 51 hours

According to Elliptic, the theft took place between 5:05 a.m. and 8:56 a.m. KST on Oct. 30, and losses totaled about $6.43 billion. Of that, $3.46 billion, or 54%, was in stablecoins such as USDT and USDC. Tether froze the USDT that arrived on Ethereum within 37 minutes, and Circle froze all $823 million of USDC before any of it could be swapped. Before those freezes, the attacker had converted about $786 million of stablecoins into other assets.

Tron was the center of the laundering. About 32,000 transactions took place on Tron alone, peaking at 1,300 in a single hour, or one every three seconds. On average, each dollar that passed through Tron was moved nine times.

1. Oct. 30, 11:19A distribution wallet began sending 684.6 million TRX in small amounts to hundreds of new addresses, eventually reaching about 7,700 addresses
2. Oct. 31, 12:36Some TRX was swapped for USDD, a stablecoin marketed as "freeze-free"
3. Nov. 1, 14:33Distribution on Tron stopped with the 1,113th transfer, after 51 hours
4. Nov. 1, 14:55Bitcoin from the Tron funds began entering coinjoins
5. Nov. 2, 11:12All 233 million XRP was moved to six new addresses

Times are KST, converted from the UTC times given by Elliptic. Chainalysis also said on its official X account early on Nov. 2 KST that "North Korean-linked actors have begun a new phase of laundering the funds stolen from Binance," adding that after draining $500 million from Tron staging wallets, the launderers had started moving onto Solana.

Solana into bitcoin, bitcoin into mixers

On-chain tracker Lookonchain said on the evening of Nov. 1 that the attacker had moved 486,970 SOL (about $46.4 million) out of 970,522 stolen SOL and was swapping it for bitcoin through cross-chain service Relay. Elliptic also confirmed that about half of the SOL had been moved to a new address that day.

Some of the bitcoin went into coinjoins. According to Elliptic, the bitcoin sent to coinjoins came from the Tron funds and from part of the parked ETH that was swapped. A coinjoin bundles transactions from many users into one, making it hard to tell whose funds went where. Elliptic said that by 3 p.m. KST on Nov. 2, about 28 BTC ($2.2 million) had passed through 18 coinjoins, each mixing between 101 and 491 inputs. Funds sent directly to an exchange were also spotted. Lookonchain said on Nov. 2 that the attacker had deposited $250,000 into Gate over 12 hours, and Gate said on its official X account that it had "identified and frozen the two related accounts" and would cooperate with the investigation.

$3.24 billion yet to move

Elliptic put the total frozen or seized so far at $2.85 billion and the assets still held in addresses linked to the theft at about $3.24 billion, mostly ETH and BTC. The 18,270 bitcoin split into 19 addresses on the day of the theft have not moved since. Elliptic said the amount cashed out so far appears negligible.

Elliptic noted that after the Bybit hack in February 2025, North Korea converted most of the 499,000 stolen ETH into bitcoin within ten days, and only about 3% was frozen. This time, Elliptic said: "We expect the ETH to be swapped for bitcoin in many small transactions, and then cashed out through OTC brokers over a period of months." It added that the laundering is clearly automated, but "nothing we have seen shows an AI agent making decisions."

North Korea denied involvement. According to the Korean Central News Agency, Kim Yo Jong, a department director of the Workers' Party of Korea, called the U.S. accusation "an absurd groundless rumor" and "a serious political provocation" in a Nov. 2 statement. At 8:33 a.m. KST on Nov. 3, bitcoin traded at $76,791 on Binance, down 1.8% over 24 hours. At the same time, it traded at 103,716,000 won on Upbit, and the kimchi premium (the gap between prices on Korean exchanges and global markets) was around 1.3%.