In brief
- About 44% of the $6.43 billion stolen from Binance has been frozen or seized, Elliptic said, after Tether and Circle moved within minutes to lock up stolen stablecoins.
- The attacker has used about 12,000 wallets and more than 40,000 transactions in under four days, which Elliptic calls automation, not AI.
- About $3.24 billion remains in addresses linked to the theft, and Elliptic expects a months-long cash-out through OTC brokers.
North Korean hackers are moving the $6.4 billion they stole from Binance at a blistering clip: roughly one new crypto wallet every 25 seconds.
In under four days, the attacker has spread the funds across about 12,000 wallets on 11 blockchains in more than 40,000 transactions, according to an analysis published Monday by blockchain analytics firm Elliptic.
But stablecoin issuers moved even faster. About $2.85 billion, or 44% of the haul, has been frozen or seized, compared with roughly 3% after North Korea’s $1.5 billion hack of Bybit in February 2025.
Open until resolution
Speed mattered because stablecoins made up $3.46 billion, or 54%, of the haul, and their issuers can freeze them. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker’s wallet, and Circle froze all $823 million in stolen USDC before any of it could be swapped, Elliptic found.
Before the freezes landed, the hacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on lending protocol Aave against another 59.9 million USDT, and traded 234 million USDT for Tron’s TRX token. In all, about $786 million in stablecoins got away.
Attackers began draining Binance’s hot wallets late Thursday. The FBI has since attributed the theft to TraderTraitor, a North Korean state-linked hacking group, and published hundreds of linked addresses.
Binance, which has pledged to cover all losses, reopened withdrawals Sunday and saw about $3.64 billion in net outflows in the first nine and a half hours.
BitcoinBTC · USD
$76,987−3.73%
Oct 26Oct 28Oct 30Nov 1Nov 2
$81.8k$80.1k$78.4k$76.7k
24h HighHigh$78,728
24h LowLow$76,783
VolVol$928.8M
→Buy Bitcoin with USDC
Powered by Jupiter
The laundering that followed has been relentless. On Tron, which became the main route, activity peaked at about 1,300 transactions in a single hour.
That pace fueled speculation that AI agents were doing the work. Elliptic disagreed, pointing to fixed timing, set amounts, blind retries and pauses that resemble human working hours. The firm wrote that while the laundering is clearly automated, “nothing we have seen shows an AI agent making decisions.”
About $3.24 billion remains in addresses linked to the theft, mostly ETH and the 18,270 stolen Bitcoin, which haven’t moved since the day of the attack. Elliptic believes those funds are very likely still held by North Korea, while money already being laundered may have passed to Chinese money-laundering networks.
Only a negligible amount appears to have been cashed out. About $16 million has also flowed to addresses holding proceeds of September’s Bitget exploit.
Based on the Bybit playbook, Elliptic expects the attacker to swap its ETH for Bitcoin in small batches and cash out through over-the-counter brokers over a period of months. Further freezes will be harder, the firm said, since ETH and Bitcoin can’t be frozen. The best remaining chances lie with centralized services, where the funds will eventually have to surface.
The Binance theft caps a punishing stretch for crypto security. BTCPay Server urged merchants to switch off their servers amid reports of hot wallet attacks on Monday, and Brazilian exchange Mercado Bitcoin halted withdrawals after a $40 million hack. It’s unclear whether either incident is connected to the Binance attack.
Join 72,000+ readers
Create an account to save your articles.
Add Decrypt as your preferred source to see more of our stories on Google.
