North Korean Hackers Laundering $6.4 Billion from Binance Heist via 12,000 Wallets

North Korean hackers responsible for a record-setting $6.4 billion heist from Binance are laundering the stolen crypto assets at an astonishing rate, utilizing a new wallet approximately every 25 seconds. This analysis, provided by blockchain analytics firm Elliptic, reveals a highly complex laundering operation involving 40,000 transactions, 12,000 wallets, and 11 different blockchains executed in less than four days.

Most of the laundering activity has occurred on the Tron blockchain, where funds were distributed across about 7,700 addresses before being bridged to Ethereum. Since November 1, the hackers have also begun moving assets on Ethereum, Solana, Near, and XRP. Notably, around 28 BTC (valued at approximately $2.2 million) has been mixed using Wasabi-style coinjoins.

Elliptic’s chief scientist, Tom Robinson, highlighted that $3.46 billion of the stolen assets were in stablecoins such as USDT and USDC, which can be frozen by their issuers. This urgency led the hackers to convert these stablecoins into other cryptocurrencies like Ethereum (ETH) and Tron (TRX). For instance, Tether froze the stolen USDT just 37 minutes after it was transferred, although the attacker managed to swap 434 million USDT for ETH on decentralized exchanges like Uniswap before the freeze. On the Tron network, 234 million USDT was exchanged for TRX on SunSwap before further freezes were implemented.

In total, $2.85 billion has been frozen or seized, with around $786 million of stablecoins converted prior to the freezes. The hack has been attributed to the North Korean cybercrime group TraderTraitor, which operates under the state-sponsored hacking organization known as the Lazarus Group.