North Korea Is Laundering Binance Hack Loot at One New Wallet Every 25 Seconds

In brief

• About 44% of the $6.43 billion stolen from Binance has been frozen or seized, Elliptic said, after Tether and Circle moved within minutes to lock up stolen stablecoins.
• The attacker has used about 12,000 wallets and more than 40,000 transactions in under four days, which Elliptic calls automation, not AI.
• About $3.24 billion remains in addresses linked to the theft, and Elliptic expects a months-long cash-out through OTC brokers.

North Korean hackers are moving the $6.4 billion they stole from Binance at a blistering clip: roughly one new crypto wallet every 25 seconds.

In under four days, the attacker has spread the funds across about 12,000 wallets on 11 blockchains in more than 40,000 transactions, according to an analysis published Monday by blockchain analytics firm Elliptic.

But stablecoin issuers moved even faster. About $2.85 billion, or 44% of the haul, has been frozen or seized, compared with roughly 3% after North Korea’s $1.5 billion hack of Bybit in February 2025.

Speed mattered because stablecoins made up $3.46 billion, or 54%, of the haul, and their issuers can freeze them. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker’s wallet, and Circle froze all $823 million in stolen USDC before any of it could be swapped, Elliptic found.