Chainalysis and Elliptic expect North Korean hackers to take months to launder the Binance proceeds, utilizing scripted automation and DeFi lending protocols

If you use decentralized finance protocols, you may encounter more stolen funds being funneled through them.

North Korean hackers have stolen approximately $6.4 billion in cryptocurrency from the exchange Binance. The theft occurred on October 29 and involved funds across 11 different blockchains. Analysis by Chainalysis and Elliptic indicates a highly automated and complex laundering process, utilizing an estimated 12,000 wallets and over 40,000 transactions in the first three and a half days. Initially, the hackers prioritized swapping stablecoins for less traceable assets like Ether (ETH) and Tron (TRX) before issuers could freeze them. Circle successfully froze all stolen USDC, and Tether froze some USDT. The process has since involved bridging funds across blockchains, utilizing decentralized exchanges, and employing DeFi lending protocols like Aave and JustLend. Some Bitcoin (BTC) has also been mixed using coinjoin techniques. Around $3.18 billion remains in addresses linked to the theft, with a negligible amount believed to have been cashed out. The hackers are expected to continue converting funds to Bitcoin for eventual cashing out through over-the-counter brokers and exchanges.

The sophistication and scale of the automated laundering operation suggest a well-resourced and experienced North Korean cybercrime apparatus. The rapid deployment of thousands of wallets and the continuous movement of funds across multiple blockchains and DeFi protocols highlight their technical capabilities and adaptability in circumventing traditional financial controls. This incident underscores the growing challenge for law enforcement and compliance teams to trace and interdict illicit digital assets, especially when advanced techniques like coinjoins and lending protocols are employed.

The ongoing use of DeFi lending protocols and bridging services by North Korean hackers presents a significant challenge for both regulatory bodies and exchanges aiming to prevent illicit fund flows. These technologies, while offering user benefits, also create opaque pathways that are difficult to monitor and control, increasing the risk of these funds being integrated into the legitimate financial system. Future efforts to combat crypto-enabled crime will likely require enhanced cross-chain analytics and deeper collaboration with DeFi platforms.