North Korean Hackers Laundering $6.4 Billion from Binance Heist via 12,000 Wallets

North Korean hackers responsible for a record-setting $6.4 billion heist from Binance are laundering the stolen crypto assets at an astonishing rate, utilizing a new wallet approximately every 25 seconds. This analysis, provided by blockchain analytics firm Elliptic, reveals a highly complex laundering operation involving 40,000 transactions, 12,000 wallets, and 11 different blockchains executed in less than four days.

Most of the laundering activity has occurred on the Tron blockchain, where funds were distributed across about 7,700 addresses before being bridged to Ethereum. Since November 1, the hackers have also begun moving assets on Ethereum, Solana, Near, and XRP. Notably, around 28 BTC (valued at approximately $2.2 million) has been mixed using Wasabi-style coinjoins.

Elliptic’s chief scientist, Tom Robinson, highlighted that $3.46 billion of the stolen assets were in stablecoins such as USDT and USDC, which can be frozen by their issuers. This urgency led the hackers to convert these stablecoins into other cryptocurrencies like Ethereum (ETH) and Tron (TRX). For instance, Tether froze the stolen USDT just 37 minutes after it was transferred, although the attacker managed to swap 434 million USDT for ETH on decentralized exchanges like Uniswap before the freeze. On the Tron network, 234 million USDT was exchanged for TRX on SunSwap before further freezes were implemented.

In total, $2.85 billion has been frozen or seized, with around $786 million of stablecoins converted prior to the freezes. The hack has been attributed to the North Korean cybercrime group TraderTraitor, which operates under the state-sponsored hacking organization known as the Lazarus Group.

New Insights on the Binance Hack

• Ethereum (ETH) is currently trading at $2,254.11, down 1.71% in the last 24 hours.
• ETH has dropped 4% since the Binance hack disclosure, despite the theft being four times larger than the Bybit hack.
• BitMine has increased its ETH holdings to 6,060,506 ETH, representing 4.9% of Ethereum's total supply.
• The total stablecoin market cap has decreased from $270.3 billion to $263.4 billion, indicating a $6.9 billion outflow over the past month.
• The Crypto Fear and Greed Index has fallen to 26, indicating a shift into Fear territory.

Latest Developments

Tether has successfully frozen $1.5 billion worth of USDT within 30 minutes following the Binance hack. However, $729 million managed to escape the freeze.

The situation highlights the complexities surrounding custody, ownership, and the return of assets in the cryptocurrency space.

New Developments on the Binance Heist

• Binance co-CEO Richard Teng confirmed that the exchange has replenished 95% of the tokens affected by the $6.3 billion cyber heist.
• The attack occurred on October 29, 2026, where attackers drained approximately $6.3 billion from Binance's hot wallets in about 30 minutes.
• Binance paused withdrawals immediately after the breach and resumed them on November 1, recording net outflows of $4.72 billion by that date.
• The losses were covered by the Secure Asset Fund for Users (SAFU), the Futures Insurance Fund, and corporate treasury reserves.
• Approximately $3 billion in stablecoins was frozen through cooperation with issuers and law enforcement agencies.
• The attack has been attributed to TraderTraitor, a group linked to North Korea, with FBI involvement in the investigation.
• Initial findings suggest that a compromised laptop belonging to a DevOps engineer was the entry point for the attack.
• Binance's key management systems were not compromised during the breach.
• The remaining 5% of affected tokens, while small in percentage, still represents a significant amount in value.

Latest Developments on Binance Hack

• Binance's hack, which resulted in a loss of $6.3 billion, may not be fully covered by insurance due to gaps in cyber coverage.
• The FBI has linked North Korea to the hack, complicating potential insurance claims due to exclusions for state-sponsored attacks.
• Binance has restored approximately 95% of the affected assets, with the remaining 5% consisting of less liquid tokens still being sourced.
• Initial investigations suggested a compromised employee laptop may have been involved in the breach, with further investigations revealing additional points of compromise.
• Binance has found no evidence of leaked wallet private keys and plans to release a detailed technical report on the breach.