North Korea Opens a New Wallet Every 25 Seconds to Launder $6.43B Binance Haul

One New Wallet Every 25 Seconds

North Korean hackers are laundering the $6.43 billion stolen from Binance at an automated clip that on-chain analysis puts at roughly one new crypto wallet every 25 seconds. In under four days the attacker has pushed the funds across about 12,000 wallet addresses on 11 blockchains through more than 40,000 transactions, according to a breakdown published Monday by blockchain analytics firm Elliptic. The freeze response, though, has moved faster than after any theft of this size. About $2.85 billion, or 44% of the haul, is now frozen or seized, against roughly 3% after North Korea's $1.5 billion breach of Bybit in February 2025. Stablecoins made the difference: they accounted for $3.46 billion, 54% of what was taken, and their issuers can freeze them at will. Tether locked the stolen USDT on Ethereum 37 minutes after it landed in the attacker's wallet, and Circle froze all $823 million in stolen USDC before a single unit could be swapped. The hacker still moved fast in the hours before those freezes landed, converting 434 million USDT into ether on automated market maker venues such as Uniswap, borrowing 19,762 ETH on the lending protocol Aave against another 59.9 million USDT, and trading 234 million USDT for Tron's TRX token. Roughly $786 million in stablecoins escaped that window. The drain itself began late Thursday, when attackers started emptying Binance's hot wallets. The FBI has since attributed the theft to TraderTraitor, a North Korean state-linked hacking group, and published hundreds of linked addresses. Binance, which has pledged to cover all losses, reopened withdrawals on Sunday and recorded about $3.64 billion in net outflows in the first nine and a half hours. On Tron, the main laundering route, activity peaked at about 1,300 transactions in a single hour.

Bitmine Adds 8,573 ETH, Tom Lee Backs Resilience

Bitmine chairman Tom Lee read the market's response to the attack as evidence that the sector has grown more resilient, not weaker. In a statement the company issued on Monday, Lee drew a direct comparison with the February 2025 Bybit breach, in which North Korean actors took $1.5 billion. When that hack was disclosed, ether fell 8% on the day and lost 20% within a week. After the Binance attack became public, ETH slipped only about 4%. In Lee's view, the smaller drawdown against a larger theft is the clearest available measure of how much containment has improved since early 2025. He credited Binance's financial strength, which allows the exchange to cover the losses in full, alongside the speed of the industry's response and the absence of any cascade through decentralized finance protocols. Lee also noted that the intrusion reached Binance's corporate systems rather than the blockchain infrastructure itself, a distinction that places the event in the category of exchange security failure rather than protocol failure. The same Monday statement doubled as Bitmine's weekly accumulation update. The company bought 8,573 ETH over the past week, lifting its Ethereum treasury to 6,060,506 ETH. Of that total, 5,227,037 ETH sits in staking, and Bitmine projects roughly $358 million in annualized income based on its current staking size and prevailing yield conditions. The buy means Bitmine expanded its position in the same window the market was pricing the aftermath of the Binance theft.

The $3.24 Billion That Has Not Moved

The split between frozen and unfrozen funds now defines the next phase. Roughly $3.24 billion remains in addresses linked to the theft, mostly ether and the 18,270 BTC taken in the attack, and neither has moved since the day of the breach. On-chain evidence points to those funds still being held by North Korea, while money already in the laundering flow may have passed to Chinese networks. Based on the Bybit playbook, Elliptic expects the attacker to swap its ether for bitcoin in small batches and cash out through over-the-counter brokers over a period of months, with centralized services the last real chokepoint for further freezes, since ETH and BTC cannot be frozen. Elliptic also rejected the AI-agent narrative around the laundering pace: timing is fixed, amounts are set, retries are blind and pauses match human working hours, and the firm wrote that “nothing we have seen shows an AI agent making decisions.” The operation reads as scripted automation rather than an AI crypto wallet agent at work. Only a negligible amount appears to have been cashed out so far, though roughly $16 million has surfaced at addresses holding proceeds of September's Bitget exploit, a link whose purpose is not yet disclosed.