Blockchain analytics firm Elliptic reported that North Korean hackers linked to the TraderTraitor group are laundering approximately $6.43 billion stolen from Binance at a rate of one new wallet every 25 seconds. In under four days, the attackers distributed funds across roughly 12,000 wallets on 11 blockchains via more than 40,000 transactions. Stablecoin issuers Tether and Circle acted swiftly, freezing or seizing about $2.85 billion, which represents 44% of the total haul. This recovery rate contrasts sharply with the 3% frozen following the February 2025 Bybit hack.
Despite these freezes, approximately $786 million in stablecoins escaped before being swapped for other assets like Ethereum and Tron’s TRX token. The attacker also utilized decentralized exchanges and lending protocols such as Aave to move funds. Currently, about $3.24 billion remains in addresses associated with the theft, primarily consisting of Ethereum and Bitcoin that have not moved since the initial attack. Elliptic attributes the rapid movement to automation rather than artificial intelligence, noting fixed timing and human-like working patterns in the transaction logs.
Binance has pledged to cover all losses and reopened withdrawals, experiencing $3.64 billion in net outflows within nine and a half hours. Elliptic anticipates a months-long cash-out process involving over-the-counter brokers, particularly for non-freezable assets like Bitcoin and Ethereum. The incident coincides with other security breaches, including a $40 million hack at Brazilian exchange Mercado Bitcoin and reports of attacks on BTCPay Server merchants.
The scale and speed of this laundering operation highlight the critical importance of centralized stablecoin issuer intervention in mitigating large-scale crypto thefts. While the freezing of 44% of the stolen funds demonstrates effective coordination between blockchain analytics firms and issuers like Tether and Circle, it also underscores the limitations of current defenses against non-custodial assets. The remaining $3.24 billion, largely in Ethereum and Bitcoin, presents a persistent challenge because these assets cannot be frozen by issuers, leaving law enforcement and exchanges reliant on tracing and eventual seizure through centralized gateways.
Elliptic’s clarification that the activity is automated but not AI-driven corrects a potential misinterpretation of the threat landscape, emphasizing that sophisticated scripting tools remain the primary vector for high-volume laundering. The expectation of a prolonged cash-out period suggests that the financial impact on North Korea may be delayed rather than immediate, but the sheer volume of funds involved poses significant risks to market liquidity and trust. As attackers shift focus to over-the-counter brokers and Chinese money-laundering networks, the burden falls increasingly on traditional financial compliance systems to detect and intercept these flows before they convert into usable fiat currency.
