North Korea Moves Binance Hack Funds Into New Wallets Rapidly

State-linked hackers from North Korea are rapidly shifting billions of dollars stolen from an exchange attack into thousands of newly generated crypto wallets. Recent intelligence regarding north korea reveals that the attacker has spread funds across approximately 12,000 wallets spanning 11 blockchains through more than 40,000 transactions in under four days, based on findings from blockchain analytics firm Elliptic.

Transactions involving the stolen cryptocurrency reached a blistering pace, averaging one new wallet every 25 seconds. The intrusion began when attackers drained hot wallets late Thursday. The FBI subsequently attributed the breach to TraderTraitor, a hacking group linked to the North Korean state, and published hundreds of associated addresses.

Stablecoin issuers froze billions of the stolen haul much faster than in previous exchange attacks.

Despite the relentless laundering activity, stablecoin issuers responded with unprecedented speed. Around $2.85 billion, representing 44 percent of the total stolen haul, has already been frozen or seized. Tether blocked stolen USDT on Ethereum within 37 minutes of arrival, and Circle secured all $823 million of stolen USDC before any swaps could occur. In contrast, only about 3 percent was recovered following a previous $1.5 billion hack of Bybit.

Before the freezes took effect, the perpetrators managed to swap substantial sums on decentralized exchanges, borrow assets against stablecoins, and trade tokens on Tron, which served as the primary laundering route with hourly transaction peaks reaching 1,300. Elliptic noted that the automation displays fixed timing and human-like work pauses rather than autonomous artificial intelligence decision-making.

Binance, which pledged to cover all losses from the incident, reopened user withdrawals on Sunday. The exchange experienced approximately $3.64 billion in net outflows during the first nine and a half hours following resumption.

Why it matters

This incident highlights significant vulnerabilities in cryptocurrency security and demonstrates how quickly stablecoin issuers can intervene to recover stolen digital assets compared to decentralized tokens. The freezing of billions in funds alters the financial calculus for state-backed cyberattacks, though recovery efforts will face greater challenges as the remaining holdings transition into unfreezable assets like Bitcoin and Ethereum.