Key Takeaways
- • North Korean hackers stole $6.3 billion in cryptocurrency from Binance, with the FBI attributing the theft to North Korea's TraderTraitor operation; about $3 billion was frozen before it could be transferred, leaving roughly $3.3 billion unfrozen according to The New York Post.
- • Blockchain intelligence firm TRM Labs said most of the Binance funds moved across 10 blockchains within about 20 minutes, after which Chinese money-laundering teams reportedly took over the transactions.
- • Elliptic reported that the laundering operation used about 12,000 digital wallets in its first three and a half days, roughly one new wallet every 25 seconds, complicating but not eliminating traceability.
- • The theft equals roughly North Korea's $3.13 billion in recorded merchandise trade last year and more than a third of its UN-estimated 2024 GDP of $17.2 billion, according to the report.
- • Experts told The Post that laundered proceeds will likely fund weapons and missile development, and that recovering the funds would depend on Chinese cooperation.
Summary
North Korean hackers stole $6.3 billion in cryptocurrency from Binance, according to a New York Post report. The FBI blamed North Korea's TraderTraitor operation for the theft, and about $3 billion was frozen before it could be transferred. Binance has said it has set aside funds to cover any losses to customers. North Korea's government, through Kim Yo Jong, rejected the accusation as a "grave political provocation" in a statement carried by state media.
According to blockchain intelligence firm TRM Labs, most of the stolen funds moved across 10 blockchains in about 20 minutes, and attackers quickly swapped assets that issuers could freeze into unsanctioned cryptocurrencies. TRM investigator Nick Carlsen said Chinese money-laundering teams took over after the initial transfers and are handling nearly all subsequent transactions. Blockchain analytics firm Elliptic found the operation used about 12,000 wallets in its first three and a half days. Carlsen said TRM has observed overlap between this laundering and a Chinese network that handled earlier North Korean thefts, with launderers taking a percentage and converting crypto into yuan in Chinese bank accounts or payment cards.
Experts quoted by The Post said the proceeds will likely support North Korea's weapons and missile programs. Geoff White, author of "The Lazarus Heist," described the stolen crypto as an international slush fund that lets the regime move money without banks. Carlsen said the inflows give the regime hard currency for its priorities, which he described as weapons development and internal improvements. White noted that China's restrictions on overseas transfers have created demand for underground banking services, and that hackers may operate from China, helping them blend into other countries' internet traffic.
The Post also cited past cases: a 2023 prosecution accused North Korean banker Sim Hyon Sop of working with Chinese and Hong Kong traders to convert stolen crypto into dollar payments using Hong Kong front companies. Carlsen said recovering the funds would depend on Chinese cooperation, and that targeting the individuals handling the laundering may be more practical than pursuing the hackers.
According to blockchain intelligence firm TRM Labs, most of the stolen funds moved across 10 blockchains in about 20 minutes, and attackers quickly swapped assets that issuers could freeze into unsanctioned cryptocurrencies. TRM investigator Nick Carlsen said Chinese money-laundering teams took over after the initial transfers and are handling nearly all subsequent transactions. Blockchain analytics firm Elliptic found the operation used about 12,000 wallets in its first three and a half days. Carlsen said TRM has observed overlap between this laundering and a Chinese network that handled earlier North Korean thefts, with launderers taking a percentage and converting crypto into yuan in Chinese bank accounts or payment cards.
Experts quoted by The Post said the proceeds will likely support North Korea's weapons and missile programs. Geoff White, author of "The Lazarus Heist," described the stolen crypto as an international slush fund that lets the regime move money without banks. Carlsen said the inflows give the regime hard currency for its priorities, which he described as weapons development and internal improvements. White noted that China's restrictions on overseas transfers have created demand for underground banking services, and that hackers may operate from China, helping them blend into other countries' internet traffic.
The Post also cited past cases: a 2023 prosecution accused North Korean banker Sim Hyon Sop of working with Chinese and Hong Kong traders to convert stolen crypto into dollar payments using Hong Kong front companies. Carlsen said recovering the funds would depend on Chinese cooperation, and that targeting the individuals handling the laundering may be more practical than pursuing the hackers.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.