From Decrypt · By Decrypt Staff
In brief
About 44% of the $6.43 billion stolen from Binance has been frozen or seized, Elliptic said, after Tether and Circle moved within minutes to lock up stolen stablecoins.
The attacker has used about 12,000 wallets and more than 40,000 transactions in under four days, which Elliptic calls automation, not AI.
About $3.24 billion remains in addresses linked to the theft, and Elliptic expects a months-long cash-out through OTC brokers.
North Korean hackers are moving the $6.4 billion they stole from Binance at a blistering clip: roughly one new crypto wallet every 25 seconds.
In under four days, the attacker has spread the funds across about 12,000 wallets on 11 blockchains in more than 40,000 transactions, according to an analysis published Monday by blockchain analytics firm Elliptic.
But stablecoin issuers moved even faster. About $2.85 billion, or 44% of the haul, has been frozen or seized, compared with roughly 3% after North Korea’s $1.5 billion hack of Bybit in February 2025.
PredictCryptoEthereum next move: Pump to $3K or Dump to $1.5K?
49%51%$3K$1.5K$154.47K volumeOpen until resolutionOpen until resolutionSpeed mattered because stablecoins made up $3.46 billion, or 54%, of the haul, and their issuers can freeze them. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker’s wallet, and Circle froze all $823 million in stolen USDC before any of it could be swapped, Elliptic found.
Before the freezes landed, the hacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on lending protocol Aave against another 59.9 million USDT, and traded 234 million USDT for Tron’s TRX token. In all, about $786 million in stablecoins got away.
Attackers began draining Binance’s hot wallets late Thursday. The FBI has since attributed the theft to TraderTraitor, a North Korean state-linked hacking group, and published hundreds of linked addresses.
Binance, which has pledged to cover all losses, reopened withdrawals Sunday and saw about $3.64 billion in net outflows in the first nine and a half hours.
BitcoinBTC · USD$77,019−3.75%Oct 26Oct 28Oct 30Nov 1Nov 2$81.8k$80.1k$78.4k$76.7k24h HighHigh$78,72824h LowLow$76,783VolVol$920.9M→Buy Bitcoin with USDCPowered by JupiterPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →The laundering that followed has been relentless. On Tron, which became the main route, activity peaked at about 1,300 transactions in a single hour.
That pace fueled speculation that AI agents were doing the work. Elliptic disagreed, pointing to fixed timing, set amounts, blind retries and pauses that resemble human working hours. The firm wrote that while the laundering is clearly automated, “nothing we have seen shows an AI agent making decisions.”