North Korean Hackers Launder $6.4B Binance Haul, Elliptic Says

Hackers behind last week’s $6.4 billion theft from Binance are laundering the stolen crypto through a new wallet roughly every 25 seconds, according to a new analysis from blockchain analytics firm Elliptic, as reported by dailyhodl.com.

Elliptic said the laundering operation is highly automated, involving 40,000 transactions, 12,000 wallets and 11 different blockchains carried out in less than four days. Most of the laundering activity has run through the Tron network, where funds were split across roughly 7,700 addresses before being bridged to Ethereum. Since November 1, assets on Ethereum, Solana, NEAR and XRP have also started moving, and for the first time some funds have been passed through Wasabi-style coinjoin mixers, with about 28 BTC, worth roughly $2.2 million, processed this way.

Tom Robinson, Elliptic’s chief scientist and co-founder, said that $3.46 billion of the stolen crypto was in stablecoins such as USDT and USDC, which issuers can freeze, making it a priority for the attackers to convert those holdings into assets like ETH and TRX. Tether froze stolen USDT on Ethereum 37 minutes after it arrived, but the attackers had already swapped 434 million USDT for ETH on decentralized exchanges including Uniswap, and borrowed 19,762 ETH on the lending protocol Aave against 59.9 million USDT in collateral. On Tron, 234 million USDT was swapped for TRX via SunSwap before Tether froze the remainder. Circle froze all 823 million stolen USDC before any of it could be moved.

Elliptic said a total of $2.85 billion has now been frozen or seized, while about $786 million in stablecoins was converted before the freezes took effect. Blockchain analytics firm Chainalysis has attributed the hack to TraderTraitor, a group believed to operate under North Korea’s state-sponsored Lazarus Group.

Based on reporting by dailyhodl.com.