How North Korea is laundering $6.4 billion stolen from Binance

The money stolen from Binance on 29 October is being laundered by software running on a timetable, according to blockchain analysts tracking it. The FBI, which attributed the theft to North Korea's TraderTraitor activity on 31 October, has asked the services that the laundering depends on to block the addresses involved.

The FBI's alert lists 608 Ethereum addresses, plus separate lists of Bitcoin and Solana addresses, that it says hold or have held proceeds of the theft. It asks THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block transactions "with or derived from" them. The agencies said the stolen assets were being converted mainly into Ether, ahead of further laundering through DeFi and instant swap services.

A laundering process that runs by itself

Chainalysis reported on 30 October that the funds were moving in thousands of transactions within a short period, circulating among addresses and often returning to addresses used earlier in the sequence. It attributed the pattern to automation.

Elliptic described the same behaviour in more detail. As of 08:11 UTC on 31 October, the main distribution wallet on the Tron blockchain had paid out every hour for 31 hours, with no gap longer than 46 minutes. Swaps into THORChain repeated the same amounts, one of them 19 times. When a bridge rejected deposits, the funds were sent again automatically from new wallets.

How the funds get past stablecoin freezes

Stablecoin issuers can freeze tokens held by known theft addresses. Chainalysis traced a method the thieves have used on Tron since the first hours to avoid that. They swapped TRX for stablecoins, deposited the stablecoins in a DeFi lending protocol and received deposit tokens in return. The issuer cannot freeze the deposit tokens. The thieves moved them to new wallets, redeemed them for stablecoins there and bridged the proceeds out to Ether.

Freezes have still caught a large share. By 30 October Elliptic had verified about $2.84 billion, 44% of the $6.43 billion taken, as frozen. Chainalysis said Circle and Tether had contributed to $2.8 billion in freezes.

One route stopped for an unrelated reason. On 31 October an Ethereum reorganisation caused THORChain to refund a 10 ETH deposit twice. That tripped an automatic solvency check and halted most of its cross-chain swaps, which has held up a significant amount of the laundering, Chainalysis said. THORChain's founder, who says he left the project long ago, wrote on 1 November that the halt was not made at anyone's request, that a fix should bring the network back online automatically, and that it would then be up to node operators to decide how to respond. THORChain has not said whether its nodes will act on the FBI's request.

What screening has to change

Because new addresses keep appearing, a wallet that passes a check today can receive stolen funds hours later. Elliptic advises exchanges and other services to screen continuously and set alerts rather than rely on one-off checks or static lists. Its free blocklist of exploit addresses is updated as investigators trace new ones. The FBI asks anyone with information to contact a field office or the Internet Crime Complaint Center at ic3.gov.

How the attackers got into Binance's hot wallets has not been published in full. The Hacker News has the background on TraderTraitor's earlier thefts and methods.