North Korean hackers have moved an estimated $6.43 billion in stolen cryptocurrency through thousands of wallets and multiple blockchain networks following the October 29 Binance-related theft, according to blockchain analytics firm Elliptic. The laundering operation involved more than 12,000 wallet addresses and over 40,000 transactions in fewer than four days, with a new wallet reportedly appearing approximately every 25 seconds.
The scale and speed of the operation highlight how sophisticated cryptocurrency laundering networks have become. Rather than moving stolen funds through a handful of addresses, the attackers distributed assets across multiple networks, using decentralized exchanges, cross-chain bridges and lending protocols to complicate transaction tracing.
The FBI attributed the theft to North Korea’s TraderTraitor hacking group. Elliptic’s investigation indicates that the attackers relied heavily on automated transaction processes to distribute and move the stolen cryptocurrency.
Despite the extensive activity, blockchain investigators and cryptocurrency companies have already managed to freeze or seize approximately $2.85 billion, representing roughly 44% of the reported stolen funds.
North Korean Hackers Use Thousands of Wallets to Move Stolen Crypto
According to Elliptic, the attackers initially distributed portions of the stolen assets across approximately 7,700 Tron addresses before moving funds through cross-chain infrastructure, primarily toward Ethereum.
The operation subsequently expanded across several blockchain networks, including Solana, NEAR and XRP.
Investigators identified a combination of techniques designed to make the movement of stolen assets more difficult to follow. These included splitting funds into smaller amounts, swapping tokens through decentralized exchanges, moving assets between blockchains and using lending protocols to create additional transaction paths.
The attackers also used Bitcoin CoinJoin transactions, which combine multiple users’ Bitcoin transactions to make it harder to establish which outputs correspond to particular inputs.
The creation of a new wallet every 25 seconds showcases the scale of distribution. However, this doesn’t guarantee that funds have been laundered or converted into cash.
Much of the activity remains visible on public blockchains, allowing analytics firms and investigators to continue tracking associated transactions.
Tether and Circle Freeze Billions in Stolen Cryptocurrency
One of the most significant developments in the investigation has been the amount of cryptocurrency frozen through coordinated intervention.
Elliptic estimates that approximately $2.85 billion in stolen assets has been frozen or seized. The response highlights the role centralized stablecoin issuers can play in disrupting cryptocurrency laundering operations.
Tether reportedly froze stolen USDT on Ethereum within 37 minutes of the funds reaching the attacker’s wallet. Circle also froze approximately $823 million in stolen USDC before it could be exchanged.
However, approximately $786 million in stablecoins had already been converted before the freezes took effect.
The ability to blacklist suspicious addresses gives centralized stablecoin issuers an intervention mechanism that does not exist in the same form for decentralized cryptocurrencies such as Bitcoin and Ether.
This distinction is important because once stolen assets are converted into cryptocurrencies without a centralized issuer capable of freezing them, recovery becomes considerably more complicated.
Billions in Bitcoin and Ethereum Remain Under Investigation
Despite the reported recovery efforts, approximately $3.24 billion in stolen cryptocurrency remained outside the frozen or seized category in Elliptic’s November 2 tracking snapshot.
The investigation identified approximately 18,270 BTC remaining in associated addresses without moving, alongside around 68,700 ETH distributed across approximately 850 smaller addresses.
Investigators also tracked approximately 233 million XRP transferred into six new addresses.
Some of the stolen Bitcoin had entered CoinJoin transactions, adding another layer of complexity to transaction attribution.
Nevertheless, these techniques do not make cryptocurrency completely untraceable. Bitcoin and Ethereum transactions remain publicly accessible, allowing blockchain analytics firms to identify transaction patterns and monitor funds as they move between addresses.
The distinction between moving stolen cryptocurrency and successfully cashing it out is equally important. Transferring assets between wallets, swapping tokens or using cross-chain bridges does not necessarily mean the attackers have converted their holdings into spendable funds.
To realize the value of their stolen assets, the attackers eventually need counterparties capable of exchanging cryptocurrency for other assets or fiat currency. Exchanges and over-the-counter brokers therefore remain important points of intervention.
Automated Transactions Raise Questions About AI-Powered Laundering
The speed of the operation has also raised questions about whether artificial intelligence is being used to coordinate large-scale cryptocurrency laundering.
However, Elliptic has not found evidence that autonomous AI agents independently directed the operation.
Instead, the transaction patterns suggest conventional automation, potentially involving scripts designed to distribute funds, execute repeated transfers, conduct small test transactions, and retry failed operations.
This distinction matters because automated cryptocurrency transactions are not necessarily evidence of sophisticated AI systems making independent decisions.
The operation demonstrates how existing automation tools can already coordinate complex financial activity across multiple blockchain networks without requiring autonomous AI agents.
Binance Hack Recovery Efforts Highlight Stablecoin Security
The amount of cryptocurrency frozen in this incident also provides an interesting comparison with the February 2025 Bybit hack.
Elliptic estimates that approximately 3% of the stolen funds from the Bybit incident were frozen, compared with roughly 44% in the current investigation.
While the circumstances and recovery conditions differ, the comparison illustrates how coordination between blockchain analytics firms, exchanges, stablecoin issuers and law enforcement can influence the outcome of large-scale cryptocurrency thefts.
It also raises broader questions about the role of centralized infrastructure in an industry built around decentralized financial systems.
Stablecoin issuers can freeze assets under their control, but Bitcoin and Ether do not have equivalent issuer-level mechanisms. Consequently, the ability to recover stolen funds varies considerably depending on the assets involved and where they are transferred.
What Happens Next?
The investigation is likely to focus on the remaining cryptocurrency, particularly Bitcoin and Ethereum holdings associated with the attackers.
Further stablecoin freezes remain possible if stolen assets pass through centralized infrastructure. Meanwhile, exchanges and over-the-counter brokers will need to monitor incoming transactions linked to identified addresses.
The movement of the approximately 18,270 BTC and the distribution of ETH across hundreds of wallets will also provide important indicators of the attackers’ next steps.
For now, the reported $2.85 billion in frozen or seized cryptocurrency demonstrates that large-scale blockchain laundering operations are not beyond the reach of coordinated intervention.
However, the remaining billions highlight the limitations of current recovery mechanisms when stolen assets move through decentralized networks and cross-chain infrastructure.
