North Korean cybercriminals responsible for stealing roughly $6.3 billion (around 8.4 trillion KRW) from Binance, the world’s leading cryptocurrency exchange, have initiated a “secondary laundering” phase to transform the illicit funds into Bitcoin. After the initial breach, where the stolen assets were distributed across temporary digital wallets, the hackers have since transferred the funds through various wallets and blockchains, even switching between different cryptocurrencies to complicate tracking efforts.
As reported by cryptocurrency news platform The Block and blockchain analytics firm Lookonchain, the hackers have begun swapping 970,522 stolen Solana tokens for Bitcoin. At the time of detection, this transaction equated to about $95.9 million. Lookonchain noted that 486,970 of these tokens were moved within a single hour and are being converted into Bitcoin using a “relay protocol,” enabling cross-chain asset transfers.
The stolen assets have passed through numerous blockchains and digital wallets. According to a report published on the 2nd (local time) by blockchain analytics company Elliptic, within less than four days after the hack, around 12,000 wallets and 11 distinct blockchains were involved, with over 40,000 transactions recorded. This strategy involves breaking down the funds, converting them into alternative cryptocurrencies, and moving them to new addresses—effectively overwhelming investigators by drastically increasing the number of transactions to trace.
Converting the funds into Bitcoin or Ethereum is also intended to evade asset freezes. Stablecoins tied to the U.S. dollar or other fiat currencies can be frozen by their issuers if traced back to stolen funds. However, Bitcoin and Ethereum do not have centralized authorities capable of such actions. Elliptic stated that approximately $2.85 billion of the seized or frozen assets in this case consisted of stablecoins. Still, even after conversion to Bitcoin, transactions may be blocked or reclaimed if the funds are identified as stolen upon reaching exchanges.
Experts believe automated software might have been used due to the speed and volume of transactions. However, Elliptic’s report clarified, “Although the laundering process appears automated, there is no evidence that AI agents were involved in decision-making.
Greater movement of funds does not indicate that the hackers have fully liquidated their gains. Elliptic estimates that only a small fraction has actually been converted into cash, as most transactions have merely involved changing cryptocurrency types or shifting funds between public blockchain wallets. Future attempts to cash out—likely through over-the-counter brokers or crypto exchanges—are expected, with these steps considered crucial opportunities to intercept and recover the stolen assets.
The U.S. Federal Bureau of Investigation (FBI) officially identified North Korea’s “TraderTraitor” group as the mastermind behind the Binance hack, which took place on the 29th of last month, in an alert issued on the 31st. Alongside the U.S. Secret Service and South Korea’s National Tax Service criminal investigation division, the FBI confirmed the hackers’ focus on converting stolen assets primarily into Ethereum. They urged the cryptocurrency sector to block transactions linked to the implicated wallets.
Leave a Reply