North Korean hackers are expected to take months to launder billions of dollars of tokens stolen from crypto exchange Binance last week, despite using sophisticated automation to hide their tracks. The FBI attributed the heist to the hacker group Trader Traitor, linked to the secretive state, expecting stolen assets to be widely laundered before being cashed out. Of the $6.3 billion initially stolen, about $3.3 billion remains under the group's control after some tokens were frozen.
Although thieves began laundering immediately using automated tools for thousands of transactions, crypto-tracing experts say the process will take months or longer. The stolen tokens are visible on public blockchains, but hackers are shifting them in small quantities through numerous venues to make tracing difficult. "This is going to be weeks, months and maybe even years... They will sit on them for a long period of time and try to identify opportunities to cash out," said Phil Larratt, senior director of global services at Chainalysis.
Binance co-founder Changpeng Zhao confirmed the exchange is investigating how hackers compromised its systems. Key to the laundering effort are decentralized finance lending markets and crypto swapping services used to convert stolen tokens into other assets. Hackers are using sophisticated automation to split and send funds to thousands of new wallets.
The Tron blockchain, created by crypto mogul and Donald Trump donor Justin Sun, is seen as an important tool for money launderers. Analytics company Elliptic reported each dollar laundered through Tron had already moved nine times by the weekend. At peak activity on Saturday, one transaction was sent every three seconds.
Conventional software automation was used, rather than agentic AI, with pauses resembling human working patterns. Minutes after the theft, hackers swapped $434 million worth of USDT for ethereum.
Source: Financial Times Markets · Summarized by HeadlinesBriefing