What happened
On October 29, crypto assets worth $6.43 billion were stolen from Binance, one of the world's largest crypto exchanges. The funds were held on 11 different blockchain networks. Binance said the attack began with the compromise of a laptop belonging to one of the company's engineers. The previous article describes the attack itself and the grounds for identifying the possible perpetrators in detail. The laundering that followed proved extremely sophisticated: in the first three and a half days, the attacker used about 12,000 wallets across 11 blockchains and carried out more than 40,000 transactions.
Below is a step-by-step, day-by-day reconstruction of how the stolen funds were laundered. «The attacker» refers to whoever currently controls the wallets that hold these assets. Blockchain data makes it possible to see the wallets themselves and the movement of funds between them, but it does not reveal the identities of the people behind the operations.
The bars show the periods of activity of each stage based on blockchain operations recorded up to 08:40 UTC on November 3, 2026. The arrows mark stages that were still ongoing at the data cutoff.
October 29: a race against the freezes
The theft lasted from 20:05 to 23:56 UTC on October 29. Of the $6.43 billion in stolen assets, $3.46 billion, or 54%, was in stablecoins such as USDT and USDC. The companies that issue these tokens, including Tether and Circle, are able to block them. So the attacker's first task was to swap the stablecoins for assets that cannot be frozen this way, such as ETH and TRX.
On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived. Before the freeze, the attacker managed to swap 434 million USDT for ETH through decentralized exchanges (DEX) such as Uniswap. In addition, he borrowed 19,762 ETH on the Aave lending protocol, putting up another 59.9 million USDT as collateral.
On Tron, the attacker swapped 234 million USDT for TRX through SunSwap before Tether froze the remaining funds. Circle managed to block all 823 million stolen USDC before they could be swapped.
Token volumes are shown in millions, and stablecoins are valued at $1 per token. Time is counted from the moment the funds arrived at the attacker's wallet until they were blocked by the issuer.
In total, about $2.85 billion was frozen or seized. About $786M in stablecoins was swapped before the freezes took effect.
In the same half hour, the stolen 18,270 BTC was spread across 19 addresses. These funds have not moved since.
October 30: Tron becomes the main route
After the first hour, there was almost no movement of funds on Tron for about five hours. Then, at 02:19 UTC on October 30, a single distribution wallet began sending the attacker's 684.6 million TRX in small amounts to hundreds of new addresses. The funds were eventually spread across about 7,700 wallets.
Over the next two and a half hours, the attacker used six different cross-chain bridges for the first time, mostly testing them with small transfers. Such bridges make it possible to send an asset from one blockchain and receive a corresponding asset on another network. Almost all the TRX was moved to Ethereum as ETH. So far, assets worth at least $147M have been moved out of Tron through cross-chain bridges.
On Ethereum, the incoming ETH was sent to newly created addresses, after which the funds stopped moving. Now about 68,600 ETH is spread across about 840 such small wallets. Most of them hold between 10 and 100 ETH. The nine largest addresses, which hold 89% of all the attacker's ETH, have not moved funds since October 30.
October 31: new routes and faster operations
On October 31, the attacker added new laundering routes. From 03:36 UTC, part of the TRX began to be swapped for USDD – a stablecoin positioned as freeze-resistant, meaning one that cannot be blocked by a single centralized organization.
From 05:18 UTC, one of the addresses ran 128 million TRX through the JustLend lending pool: the funds were deposited from one wallet and withdrawn to 16 new addresses. There were no direct transfers between the sending and receiving addresses.
The distribution wallet also began working faster. While for most of October 30 it sent less than 12 million TRX per hour, on October 31 its speed reached 37 million TRX per hour. The operations continued through both nights, Pyongyang time. At the busiest point, at 08:00 UTC on October 31, the attacker's wallets on Tron were carrying out about 1,300 transactions per hour.
The chart shows transfers from the distribution wallet from 02:19 UTC on October 30 to 05:33 UTC on November 1.
Late in the evening of October 31, the FBI attributed the theft to the TraderTraitor group and published the attacker's wallet addresses.
November 1: activity on Tron dies down, funds start moving on other networks
By about 05:00 UTC on November 1, activity on Tron had largely stopped. The last transfer from the distribution wallet was made at 05:33 UTC. In 51 hours, 1,113 transfers were sent from it.
Then funds on other blockchains started moving. From 07:00 UTC, NEAR tokens began to be transferred to new addresses. From 08:19 UTC, part of the ETH that had until then stayed put began moving again – in batches of about 10 ETH. From 09:38 UTC, about half of the stolen SOL was sent to a new address, from which small amounts then began to be withdrawn gradually. The NEAR has not moved since.
On this day, the stolen funds were also mixed for the first time. From 05:55 UTC, bitcoin obtained from operations with assets from Tron began to be sent into so-called CoinJoin transactions using WabiSabi – the protocol used in Wasabi Wallet and similar wallets.
Later the same day, part of the ETH that had been left untouched was swapped for bitcoin. Most of the resulting BTC was also sent through CoinJoin. By 06:02 UTC on November 2, about 28 BTC worth $2.2M had passed through 18 such operations.
The diagram is simplified. In this case, each CoinJoin transaction included between 101 and 491 inputs.
Crypto mixers: how they work and what their trace in a wallet history meansSep 3, 2026Read more
November 2: XRP moves and SOL is swapped for bitcoin
Early on the morning of November 2, the XRP started moving for the first time since the theft. Between 02:12 and 04:00 UTC, all 233 million XRP were sent to six new addresses, where they remain now.
On Solana, the attacker swapped part of the SOL for USDC and then swapped the USDC back into SOL. In addition, he ran SOL through a lending pool using the same scheme as on Tron: he deposited funds from one address and withdrew them to another.
XRP volumes are based on blockchain data. The movement of funds on Solana is shown in simplified form. Wallet addresses are not shown.
November 3: SOL is withdrawn faster
On November 3, the pace of operations picked up. By 08:40 UTC, about 87,000 SOL worth $8M had been withdrawn from the original wallet that received the stolen SOL. These funds were spread across new wallets, run through lending pools and a liquid staking service, and then sold or swapped for bitcoin. About 825,000 SOL remains on the original address and related wallets, almost all of it on two addresses.
On Tron, a wallet that held about 700,000 TRX was emptied. These tokens were swapped for USDT and USDD, run through a lending market and then swapped for bitcoin. The USDT never stayed in one wallet for longer than a minute.
Small amounts of ETH also continued to be swapped for bitcoin. In total, new bitcoin addresses now hold about 200 BTC worth $15M. These funds were obtained by swapping other stolen assets.
Techniques that make the funds harder to trace
The attacker combines several common methods. None of them is new, but using them together makes tracing the stolen assets much more difficult.
Funds are spread across thousands of new addresses, which means far more individual transactions have to be tracked.
Assets are moved between blockchains using cross-chain bridges and cross-chain swap services. Depositing funds on one network and receiving them on another are recorded as separate transactions. Some batches pass through four different blockchains within a few hours.
Assets are swapped on decentralized exchanges. As a result, the token being monitored keeps changing. Funds pass through lending pools and liquid staking services on Tron and Solana. This makes it possible to avoid a direct transfer between the sender's address and the recipient's address.
Bitcoins are mixed using CoinJoin: coins from different users are combined in one transaction, which breaks the visible link between incoming and outgoing funds.
Splitting funds into small amounts does more than complicate tracing. Small batches can be swapped or moved through cross-chain bridges without causing noticeable swings in the market price. Such operations are less visible to exchanges that screen incoming funds. In addition, laundering can be carried out in small batches at whatever speed the attacker chooses.
Is the laundering automated?
The high speed of the operations has led to speculation that the funds are being moved by autonomous AI agents. However, the available data points rather to ordinary automation: fixed time intervals, preset amounts, retries without analyzing the result and new methods introduced in stages a few hours apart. There were also pauses resembling a normal human work schedule.
The scale of the operations itself points to the use of software. On Tron, the stolen funds were moved in about 32,000 transactions. At the peak, about 1,300 operations were carried out in one hour – roughly one every three seconds. Every dollar that went through the laundering scheme on Tron was moved about nine times.
Where the funds are now
The width of the bands shows the value of the assets at the time of the theft. The thin lines leading to bitcoin show swaps of SOL, TRX and ETH for BTC – so far about $15M. The labels on the right show the current value of the assets as of about 08:35 UTC on November 3, 2026. The data on frozen balances was rechecked at about 08:30 UTC.
Of the $6.43 billion stolen, $2.85 billion has been frozen. About $3.18 billion still sits at addresses linked to the theft.
Most of these funds have not yet gone through laundering schemes. This is primarily the bitcoin and ETH held on the nine largest addresses. These assets are highly likely still under North Korea's control. However, funds that are already moving through laundering schemes may have ended up in other hands.
Posing as a client: how ZachXBT infiltrated a Chinese network laundering money for LazarusOct 5, 2026Read more
In previous cases, North Korea handed stolen funds over to Chinese networks that specialize in money laundering. Blockchain data does not make it possible to establish whether this has happened in this case.
About $16M was transferred to addresses that also hold funds obtained from the Bitget hack in September 2026. That attack is also linked to the TraderTraitor group.
Have the stolen funds been cashed out?
At this point, probably only an insignificant part of the funds has been cashed out. Most of the operations carried out so far are swaps of some crypto assets for others: the assets change form, but they remain on public blockchains at addresses linked to the theft.
What happens next
After the Bybit hack in February 2025, North Korea laundered all 499,000 stolen ETH within ten days. This was mostly done by swapping Ethereum for bitcoin. However, the final cash-out took several months.
According to the investigation, the funds stolen from Bybit were eventually swapped for USDT on Tron and then withdrawn through suspected Chinese OTC trading services. Such intermediaries settle with sellers off-chain, so the public chain of transfers ends at their addresses.
So far, the laundering after the Binance hack is going more slowly. ETH and BTC cannot be frozen the way centralized stablecoins can, so the attacker has no need to hurry. In addition, the stolen amount is more than twice the damage from the Bybit hack. Trying to sell such volumes quickly would lead to significant losses due to unfavorable exchange conditions.
Finally, after the FBI published the attacker's addresses, swap services and other market participants gained the ability to track operations linked to the attack.
The ETH is expected to be gradually swapped for bitcoin in small batches, and then, over several months, there will be attempts to cash it out through OTC brokers. The SOL swaps that began on November 2 already show this pattern on a smaller scale.
Further freezes will be harder to achieve. Blocking 44% of the stolen funds is already an unusual result. After the Bybit hack, about 3% of the stolen assets were frozen. The most likely opportunities for new freezes are stablecoins that briefly land on intermediary addresses during transfers, as well as the centralized services through which the attacker will try to cash out the funds. Alerts about suspicious transfers have already helped detect such operations and get assets frozen.
