North Korea Is Laundering Binance Hack Loot at One New Wallet Every 25 Seconds

What it is

Elliptic's tracing of the laundering of the $6.43 billion taken from Binance's hot wallets, which the FBI attributed to TraderTraitor, a North Korean state-linked group. The FBI has published hundreds of linked addresses. Decrypt's report adds detail on where the money went and why the freezes worked.

How it works

Stablecoins were $3.46 billion (54%) of the haul, and their issuers can freeze them. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet. Circle froze all $823 million of stolen USDC before any was swapped.

Before the freezes, the attacker did three things:

• Swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap.
• Borrowed 19,762 ETH on Aave against 59.9 million USDT.
• Traded 234 million USDT for Tron's TRX token.

About $786 million in stablecoins escaped this way.

Tron became the main laundering route, peaking at about 1,300 transactions in one hour. Elliptic says the activity shows fixed timing, set amounts, blind retries and pauses resembling human working hours. It concludes the process is automated, and that "nothing we have seen shows an AI agent making decisions."

Preconditions / Affected

The freezes worked only on issuer-controlled assets. The remaining $3.24 billion is mostly ETH and 18,270 BTC, which cannot be frozen and have not moved since the attack. Elliptic believes North Korea very likely still holds them. Funds already laundered may have passed to Chinese money-laundering networks. About $16 million has flowed to addresses holding proceeds of the September Bitget exploit.

What to do

The page gives no commands or detections. Its implied guidance for exchanges, OTC desks and compliance teams:

• Screen against the FBI's published TraderTraitor addresses.
• Watch for ETH-to-BTC swaps in small batches, the pattern Elliptic expects from the Bybit playbook, with cash-out through OTC brokers over months.
• Treat centralized services as the main chokepoint. Elliptic says the funds must eventually surface there, and it sees these as the best remaining chance for freezes.

Caveats

Elliptic's cash-out forecast is based on the Bybit precedent, not on observed cash-out. Only a negligible amount appears to have been cashed out so far. The freeze rate was 44% ($2.85 billion), against about 3% after the February 2025 Bybit hack. Decrypt notes that BTCPay Server's call for merchants to switch off servers over reported hot wallet attacks, and a $40 million hack at Mercado Bitcoin, may not be connected to the Binance theft.