Key facts
- Elliptic said the attacker used about 12,000 wallets on 11 blockchains in more than 40,000 transactions.
- Elliptic said about $3.24 billion remains in addresses linked to the theft, mostly ETH and 18,270 Bitcoin.
- Elliptic said stablecoins made up $3.46 billion, or 54%, of the haul, which is why issuers could freeze funds.
- Elliptic said about $786 million in stablecoins got away before the freezes landed.
- Elliptic said the laundering is automated but that nothing it saw shows an AI agent making decisions.
- Elliptic said further freezes will be harder because ETH and Bitcoin cannot be frozen.
Hackers linked by the FBI to North Korea moved about $6.43 billion stolen from Binance across roughly 12,000 wallets on 11 blockchains in more than 40,000 transactions in under four days, blockchain analytics firm Elliptic said in an analysis published Monday. Elliptic described the pace as about one new wallet every 25 seconds and called the process automated rather than driven by artificial intelligence.
Stablecoin issuers moved faster. Elliptic said about $2.85 billion, or 44% of the haul, had been frozen or seized, against roughly 3% after North Korea's $1.5 billion hack of Bybit in February 2025. Stablecoins made up $3.46 billion, or 54%, of the haul, and their issuers can freeze them. Tether froze stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet, and Circle froze all $823 million in stolen USDC before any of it could be swapped, Elliptic found.
Before the freezes landed, the hacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on lending protocol Aave against another 59.9 million USDT, and traded 234 million USDT for Tron's TRX token. About $786 million in stablecoins got away, Elliptic said.
Attackers began draining Binance hot wallets late Thursday. The FBI attributed the theft to TraderTraitor, a North Korean state-linked hacking group, and published hundreds of linked addresses. Binance, which has pledged to cover all losses, reopened withdrawals Sunday and saw about $3.64 billion in net outflows in the first nine and a half hours.
Elliptic said about $3.24 billion remains in addresses linked to the theft, mostly ETH and 18,270 stolen Bitcoin that have not moved since the day of the attack. The firm said those funds are very likely still held by North Korea, while money already being laundered may have passed to Chinese money-laundering networks. Only a negligible amount appears to have been cashed out, and about $16 million has flowed to addresses holding proceeds of September's Bitget exploit.
Based on the Bybit case, Elliptic expects the attacker to swap its ETH for Bitcoin in small batches and cash out through over-the-counter brokers over months. Further freezes will be harder, the firm said, because ETH and Bitcoin cannot be frozen, leaving centralized services as the best remaining chance. The Binance theft came alongside other crypto security incidents: BTCPay Server urged merchants to switch off their servers amid reports of hot wallet attacks on Monday, and Brazilian exchange Mercado Bitcoin halted withdrawals after a $40 million hack. It is unclear whether either is connected to the Binance attack.