Running Against Freezing: After Hacking Binance for 6.4 Billion USD, How Did North Korean Hackers Launder Money?

Author | Dr. Tom Robinson (Elliptic)

Compiled by | Wu Says Blockchain, Yuanbao

The content of this article does not constitute any investment or financial advice. Readers are advised to strictly comply with the laws and regulations of their location. Please star Wu Says public account, otherwise you may not receive notifications.

TL;DR:

· Approximately $6.43 billion was stolen from Binance, involving 11 different blockchains. Within less than 4 days, the attackers used about 12,000 wallets and conducted over 40,000 transactions, indicating a high level of automation in money laundering.

· About $2.85 billion has been frozen or seized (approximately 44%), while around $3.24 billion remains in addresses related to the theft, with a very small portion possibly cashed out.

· The Tron chain became the main channel for money laundering: 684.6 million TRX was split into about 7,700 addresses and redirected to Ethereum through at least 7 cross-chain bridges.

· The attackers employed a combination of cross-chain bridge hopping, DEX exchanges, lending vault withdrawals, Coinjoin mixing, and other methods, greatly increasing the difficulty of tracking.

· Referring to the Bybit case experience in 2025, it is expected that ETH will first be exchanged for BTC and then cashed out through OTC brokers within a few months.

I. Event Review: Racing Against Freezing

On October 29, one of the world's largest cryptocurrency exchanges, Binance, was hacked for $6.43 billion worth of crypto assets, involving 11 different blockchains. Binance stated that the attack began with the hacking of an engineer's laptop.

Of the stolen funds, $3.46 billion (54%) were stablecoins (such as USDT, USDC). Since the issuers of stablecoins can freeze them, the attackers' primary task was to exchange them for assets that cannot be frozen (such as ETH and TRX).

On Ethereum: Tether froze the funds 37 minutes after the stolen USDT arrived. However, before the freeze, the attackers had already exchanged 434 million USDT for ETH on decentralized exchanges (DEX) like Uniswap and collateralized 59.9 million USDT on the Aave lending protocol to borrow 19,762 ETH.

On Tron: Before Tether froze the remaining funds, the attackers exchanged 234 million USDT for TRX via SunSwap.

Circle: All 823 million USDC was frozen before the attackers exchanged any funds.

Result: A total of $2.85 billion was frozen or seized, with approximately $786 million in stablecoins successfully converted before the freeze. Within the same half hour, 18,270 BTC were split into 19 addresses and have not moved since.

II. Tron Becomes the Main Channel, Funds Redirected to Ethereum

About 5 hours after the theft, on October 30 at 02:19 UTC, a distribution wallet began sending small amounts of the 684.6 million TRX held by the attackers to hundreds of new addresses. Ultimately, the funds spread to about 7,700 addresses.

Cross-chain bridges: Within the next 2.5 hours, the attackers transferred funds through 6 different cross-chain bridges for the first time (mostly for testing amounts). Almost all TRX was ultimately paid out in ETH on Ethereum. So far, at least $147 million has been transferred out of Tron via cross-chain bridges.

On Ethereum: The arriving ETH stopped moving after being forwarded to newly created addresses. Currently, about 68,700 ETH is distributed across approximately 850 smaller addresses (most holding 10-100 ETH). The 9 largest addresses hold 89% of the attackers' ETH and have not moved since October 30.

III. New Routes and Acceleration: Lending Vaults and USDD

On October 31, the attackers added new money laundering routes:

· Starting from 03:36 UTC, some TRX was exchanged for USDD (a stablecoin claimed to be "unfreezable").

· Starting from 05:18 UTC, one address deposited 128 million TRX into the JustLend lending vault, depositing from 1 address and withdrawing to 16 new addresses—there was no direct transfer association between sending and receiving.

Speed increase: The distribution wallet increased from less than 12 million TRX per hour for most of October 30 to as high as 37 million TRX per hour on October 31. It continued to operate during the night in Pyongyang, with the busiest time (October 31 at 08:00 UTC) seeing the attackers' Tron wallet conducting about 1,300 transactions in one hour.

On the evening of October 31, the FBI attributed the theft to TraderTraitor and released the attackers' addresses.

IV. Multi-chain Activity: NEAR, SOL, BTC Mixing, and XRP

On November 1, Tron activity basically stopped, and other chains began to become active:

· Starting from 07:00 UTC: NEAR was transferred to new accounts.

· Starting from 08:19 UTC: Some parked ETH began to move again (about 10 ETH per transaction).

· Starting from 09:38 UTC: About half of SOL was moved to new addresses, followed by small amounts being peeled off.

· First mixing: Starting from 05:55 UTC, BTC from Tron funds began to undergo Coinjoin mixing through the WabiSabi protocol (used by Wasabi Wallet and others). Later that day, some ETH was exchanged for BTC and also mixed. As of November 2, about 28 BTC ($2.2 million) had been laundered through 18 Coinjoin transactions.

On November 2, 233 million XRP moved for the first time since the theft, sent to 6 new addresses. On Solana, the attackers exchanged some SOL for USDC and then back again, transferring through lending vaults in the same manner as on Tron.

V. Six Strategies to Increase Tracking Difficulty

1. Splitting funds into thousands of new addresses: generating more transactions to track.

2. Moving across blockchains via at least 7 cross-chain bridges: deposits and payments are independent transactions on different chains.

3. Exchanging assets on DEX: the tracked assets are constantly changing.

4. Jumping into lending vaults: there is no direct transfer association between sending and receiving addresses.

5. Mixing BTC through Coinjoin: merging multiple users' coins breaks the visible link between inputs and outputs.

6. Additional benefits of splitting: small amounts can be exchanged or transferred across chains without affecting prices; less conspicuous to exchanges screening incoming funds; can be laundered in batches at a speed chosen by the attackers.

VI. Is Money Laundering Automated?

The speed of money laundering has raised speculation about "AI agents transferring funds." However, evidence suggests it is conventional automation: fixed times, set amounts, blind retries, and introducing new strategies in steps spaced hours apart. There are also pauses resembling human work patterns.

The stolen funds on Tron moved through about 32,000 transactions, peaking at about 1,300 transactions per hour (one every 3 seconds). Money laundering is clearly automated, but there is currently no evidence of AI agents making decisions.

VII. Where Are the Funds Now? Any Cash-Out?

Of the stolen $6.43 billion, $2.85 billion has been frozen, while around $3.24 billion remains in addresses related to the theft. Most has not yet been laundered (BTC and ETH in the 9 largest addresses), and these funds are highly likely still held by North Korea.

About $16 million was sent to an address that also holds the proceeds from the Bitget exploit in September 2026 (also believed to be by TraderTraitor).

As for cashing out: a very small portion may have been cashed out. To turn it into spendable money, the attackers need to go through counterparties (such as centralized exchanges or OTC brokers), which is precisely where the funds can be identified and blocked.

VIII. What Will Happen Next?

Referring to the Bybit hack case in February 2025: North Korea laundered all 499,000 stolen ETH (mainly exchanged for BTC) within 10 days, with cashing out taking several months. Elliptic found that Bybit funds were ultimately converted to USDT on Tron and cashed out through suspected OTC trading services.

The laundering in the Binance case is currently slower. Reasons include: ETH and BTC cannot be frozen, and there is no urgency. The amount is more than twice that of Bybit, and rapid movement means significant losses in exchanges. The FBI has released the attackers' addresses, and various service providers are monitoring.

It is expected that ETH will be exchanged for BTC through many small transactions and then cashed out through OTC brokers within a few months.

Further freezing will be more difficult. Being able to freeze 44% of the stolen funds is already rare (only about 3% in the Bybit case). The best remaining chance for freezing is stablecoins that are briefly captured in transit and centralized services at cash-out points.

9. Explanation of Key Terms

Original source: Elliptic Insights, Author Dr. Tom Robinson. This article is a translated compilation for informational sharing only and does not constitute any investment advice.