North Korean Hackers Laundering Record-Setting $6,400,000,000 Binance Haul via 12,000 Crypto Wallets Across 11 Chains: Elliptic

North Korean hackers behind last week’s record-setting $6.4 billion Binance heist are laundering crypto assets through a new wallet roughly every 25 seconds, per the blockchain analytics firm Elliptic.

Elliptic notes in a new analysis that the highly complex laundering process is “clearly automated,” utilizing 40,000 transactions, 12,000 wallets and 11 different blockchains in less than four days.

“Most of the laundering so far has run through Tron, where the funds were split across about 7,700 addresses and bridged to Ethereum. Since November 1, ETH, SOL, NEAR and XRP have begun to move. For the first time, some of the stolen funds have been mixed. Since November 1, about 28 BTC ($2.2 million) has been put through Wasabi-style coinjoins.”

Tom Robinson, Elliptic’s chief scientist and co-founder, notes that $3.46 billion of the crypto stolen in the hack was in the form of stablecoins like USDT and USDC, which can be frozen by their issuers. That made it a priority for the hacker to swap those stablecoins into assets like Ethereum (ETH) and Tron (TRX).

“On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived. Before the freeze, the attacker managed to swap 434 million USDT for ETH on decentralized exchanges (DEXs) such as Uniswap. It also borrowed 19,762 ETH on the lending protocol Aave against a further 59.9 million USDT. On Tron, it swapped 234 million USDT for TRX on SunSwap before Tether froze the rest. Circle froze all 823 million stolen USDC before any of it had been swapped.

In total, $2.85 billion has been frozen or seized. Around $786 million of stablecoins was converted before the freezes landed.”

The analytics firm Chainalysis attributes the record-setting hack to the North Korean cybercrime group TraderTraitor, which is believed to operate under the umbrella of the state-sponsored hacking outfit known as the Lazarus Group.