Blockchain analytics firm Elliptic says North Korean hackers are rapidly laundering the $6.4 billion taken from Binance, creating a new crypto wallet roughly every 25 seconds.
Scope of the laundering operation
In less than four days, the attackers moved funds across about 12,000 wallets on 11 blockchains, executing more than 40,000 transactions. Elliptic describes the activity as automated but not driven by artificial intelligence.
Stablecoin freezes
Stablecoins accounted for $3.46 billion (54%) of the stolen assets. Issuers acted quickly: Tether froze $2.85 billion of USDT on Ethereum 37 minutes after it entered the attacker’s wallet, and Circle froze $823 million of USDC before any swaps occurred. Overall, 44% of the total haul has been frozen or seized.
Partial swaps before freezes
Before the freezes, the hacker swapped 434 million USDT for ETH on decentralized exchanges, borrowed 19,762 ETH on Aave against 59.9 million USDT, and traded 234 million USDT for TRX. Approximately $786 million in stablecoins escaped the freezes.
Current status of the funds
Elliptic estimates $3.24 billion remains in addresses linked to the theft, primarily in ETH and the 18,270 BTC taken. Those assets have not moved since the attack and are believed to be held by North Korean actors. A small amount, about $16 million, has flowed to addresses associated with the September Bitget exploit.
Future cash‑out expectations
The firm expects the remaining ETH to be swapped for Bitcoin in small batches and cashed out through over‑the‑counter brokers over several months. Further freezes are unlikely because ETH and Bitcoin cannot be frozen, leaving centralized services as the most probable point of eventual detection.
Broader crypto security context
The Binance theft follows other recent incidents, including hot‑wallet attacks reported by BTCPay Server and a $40 million hack at Brazilian exchange Mercado Bitcoin. Connections between these events have not been established.
