North Korea Starts Mixing Binance Hack Bitcoin, Obscuring Trail of 28 BTC

A North Korean hacking group is laundering the $6.43 billion in crypto stolen from Binance by dispersing the funds across roughly 12,000 wallets and multiple blockchains, according to an analysis.

Blockchain analytics firm Elliptic said in a blog post on November 2 that fewer than four days after the Binance hack, more than 12,000 wallets and over 40,000 transactions across 11 blockchains had been used. That works out to a new wallet being created every 25 seconds on average.

Of the stolen funds, about $2.85 billion has been frozen, while roughly $3.24 billion remains in addresses tied to the hack. Most of the assets are still held in Bitcoin and Ether, and the amount actually converted into cash is believed to be minimal.

The Tron network was a main route in the laundering process. The stolen funds were split across about 7,700 addresses and then moved to Ethereum through multiple cross-chain bridges. Transfers later began in other assets as well, including Ether, Solana, Near and XRP.

Bitcoin mixing has also been identified for the first time. Elliptic said about 28 BTC had been mixed using CoinJoin since November 1. CoinJoin combines Bitcoin from multiple users into a single transaction, making it harder to trace the origin and path of the funds.

Elliptic added that the speed of the laundering alone does not mean AI agents are directly moving the funds. Regular time intervals, fixed amounts and repeated retries are more consistent with conventional automation tools. On Tron, transaction activity at one point reached about 1,300 an hour, or roughly one every three seconds.

Elliptic said the stolen Ether could eventually be converted into Bitcoin in small amounts and then cashed out over several months through over-the-counter brokers.