North Korea Laundering $6.4B Binance Heist via Automated Cross-Chain Routes

Key points

• FBI attributes the October 29 theft of $6.43 billion from Binance to North Korean group TraderTraitor.
• Elliptic identifies the laundering as highly automated, involving 12,000 wallets and 40,000 transactions in four days.
• Stablecoin issuers Tether and Circle froze $2.85 billion, but $3.24 billion remains in linked addresses.
• Funds are being moved via Tron, cross-chain bridges, and coinjoins to obscure their origin.
• Binance has replenished 95% of stolen assets, with remaining losses covered by the exchange.

Background

This incident follows the February 2025 Bybit hack, also attributed to North Korea, where stolen Ethereum was laundered within ten days. The current breach is the largest in crypto history, surpassing the $1.5 billion Bybit theft. Previous coverage noted that while stablecoin freezes are effective, they contradict crypto’s decentralization ethos, and critics argue that centralized exchanges lack the regulatory safeguards of traditional banks.

How outlets are covering it

Elliptic emphasizes the technical complexity of the laundering, noting the use of automated scripts rather than AI agents, and highlights the speed of fund movement across multiple chains. Fox Business focuses on the FBI’s official attribution and the potential for future AI-driven attacks, citing expert warnings of a 'bloodbath' in cybercrime. Yahoo Finance highlights the market impact, noting $4.6 billion in withdrawals from Binance and a 3% drop in total crypto market value. NPR provides a broader regulatory context, contrasting crypto exchanges with traditional banks and noting the lack of insurance for users, while also confirming the North Korean attribution.

Why it matters

The scale of the theft and the sophistication of the laundering techniques highlight significant vulnerabilities in centralized crypto exchanges. The involvement of a state actor like North Korea raises geopolitical concerns, as proceeds may fund weapons proliferation. The incident also underscores the limitations of current regulatory frameworks, as Binance is not legally bound to reimburse users, unlike traditional banks, and the reliance on stablecoin freezes reveals the centralized nature of crypto infrastructure.

What to watch

Elliptic expects the attacker to swap Ethereum for Bitcoin and cash out through over-the-counter brokers over several months. Further freezes are unlikely, as most stablecoins have already been frozen. Compliance teams are advised to screen against 9,500 linked addresses. The FBI and other agencies are urging exchanges to block transactions involving these addresses to prevent further laundering.