North Korea Stole $6.3 Billion From Binance. Now a Robot Is Laundering It.
The FBI has formally attributed the largest cryptocurrency theft in history to North Korean state-sponsored hackers, and is asking the crypto industry to help choke off the money before it disappears into the financial ether.
The attack happened on October 29. Hackers drained Binance hot wallets across multiple blockchains in under 20 minutes, making off with what Binance estimates at roughly $6.3 billion. Within hours, blockchain intelligence firms TRM Labs and Chainalysis had already pointed the finger at TraderTraitor, the North Korean group the FBI also blamed for the $1.5 billion Bybit hack back in February.
The FBI's formal attribution came on October 31, two days after the theft. Working alongside the Secret Service and IRS Criminal Investigation, the agency published a list of 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address connected to the stolen funds. It called on THORChain and RPC node operators, instant exchanges, DeFi platforms and blockchain analytics firms to block any transactions touching those addresses.
"TraderTraitor actors are converting stolen assets primarily into Ethereum," the FBI said, adding that the funds are expected to be pushed through DeFi services and instant swap platforms as part of a multi-stage laundering operation.
Binance, for its part, has upgraded its own assessment of what happened. CEO Richard Teng initially floated a compromised DevOps laptop as the likely entry point. That theory has since been retired. "Our subsequent investigation has uncovered additional points of breach," Teng said, describing the attack as a coordinated operation that was "not carried out by one person." The attacker also deployed a self-destruct mechanism that wiped tools and evidence as it exited, which has complicated the forensic work considerably.
Teng also flagged the attacker's use of Ethereum's EIP-7702 delegation feature, which apparently bypassed Binance's standard approval controls. A full technical post-mortem is promised once the investigation has firmer ground to stand on.
Withdrawals resumed on a phased basis from November 1, starting with Bitcoin. By mid-Sunday morning, Binance said it had processed around $4.6 billion in withdrawals and $1 billion in deposits. The exchange says roughly 95% of the stolen amount has already been covered using company funds, with the remainder being sourced through market purchases and OTC deals for the less liquid tokens.
"Binance will absorb the financial impact of the stolen funds, not our users," Teng said. Which is the right thing to say, and also the only thing you can say in this situation.
Now for the part that should worry everyone. Blockchain analytics firm Elliptic puts the total theft at $6.43 billion across 11 blockchains, with around $2.85 billion confirmed frozen or seized on-chain. That leaves approximately $3.25 billion still in motion across more than 800 addresses, held in assets no issuer can freeze: roughly 584,000 ETH, 18,327 BTC and 233 million XRP.
And whoever, or whatever, is moving that money does not appear to be human.
"In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep," Elliptic noted. A Tron wallet distributing stolen funds was paying out on an hourly schedule for more than 24 hours straight. When a cross-chain bridge refused a deposit, the system automatically rerouted funds through freshly generated wallets to reach the same destination. By the end of October 31, roughly $196 million had flowed from that single wallet to around 200 others, with THORChain processing the largest slice at about $31 million.
Chainalysis flagged similar patterns: thousands of transactions in quick succession, and a wave of new addresses whose very first transaction was exactly 1 TRX, textbook automation behaviour.
Whether this is AI-driven or just well-written scripts, nobody can say from on-chain data alone. Either way, Elliptic expects the full laundering process to take months, consistent with how long it took after Bybit. North Korea is apparently playing a long game, and it has software doing the heavy lifting.