After $6.3 Billion Was Stolen, How Do North Korean Hackers Launder the Money?
Unlike ordinary hacking groups, Lazarus is believed to have close ties to North Korea's Reconnaissance General Bureau. U.S. law enforcement agencies have repeatedly stated that North Korea obtains foreign exchange by stealing crypto assets, and even funds its weapons programs that are subject to international sanctions.
After this Binance hack, the hackers once again launched a large-scale transfer of funds. Drawing on the latest on-chain tracking, as well as historical cases such as Ronin and Bybit, we have mapped out the money-laundering path of North Korean hackers and how these stolen funds flow into the real-world financial system.
Asset conversion: Why are the hackers rushing to sell off stablecoins?
On October 29, North Korean hackers stole approximately $6.3 billion in assets from 17 Binance hot wallets, involving nine blockchains including Ethereum, Bitcoin, Tron, and Solana.
Because the stolen assets include large amounts of centralized tokens such as USDT and USDC, whose issuers have freeze authority, and some L2 networks also retain emergency management permissions and can even force the transfer of assets involved in the case.
As a result, after pulling off the heist, the hackers quickly moved the stablecoins into multiple intermediary wallets, transferring them while swapping them via DEXs into native assets such as ETH and TRX.
But a large amount of assets still could not be moved in time. According to Bitquery, about $2.7 billion in assets were frozen or controlled by issuers and related institutions, of which about $729 million in USDT was successfully transferred before being frozen.
Cross-chain transfers: Which protocols did the funds flow through?
After completing the first round of asset conversion, the hackers began using cross-chain protocols to move funds scattered across different networks to networks such as Ethereum and Bitcoin, and then disperse the funds through a large number of new wallets.
Among these, the funds on TRON are the most representative. The hackers first swapped about $234 million in USDT into 638 million TRX, then split it across multiple wallets and moved it through at least six cross-chain protocols including THORChain. As these funds were continuously split and swapped during the cross-chain process, the vast majority were ultimately converted into ETH on Ethereum.
Funds on other blockchains underwent similar operations. For example:
- Some assets on Base were bridged to Ethereum via Stargate, ultimately converging into about 1,187 ETH
- Assets on Avalanche were first swapped into USDC, then transferred to Ethereum via Circle CCTP, and finally converted into about 7,243 ETH.
In addition, based on the liquidity depth on different chains, the hackers also chose cross-chain protocols such as Relay, Chainflip, and Symbiosis to move funds in batches, in order to reduce the slippage caused by large conversions.
After cross-chain transfers, the funds did not immediately enter exchanges, but continued to be split into a large number of new wallets. For example, a batch of ETH swapped via THORChain was dispersed to 35 addresses; another batch of funds moved via Relay was swapped into ETH through CoW Swap and then dispersed to another 16 wallets.
The entire process exhibited highly automated characteristics. Elliptic found that the hackers' main TRON fund-distribution wallet completed more than 1,100 transfers between October 30 and November 1, and the new addresses receiving the funds usually sent them out again within two minutes. Even if a cross-chain transfer failed, some funds would be re-submitted for cross-chain transfer.
FBI calls for interception, cross-chain protocols respond differently
On October 31, the FBI, together with the U.S. Secret Service and the IRS Criminal Investigation division, issued an announcement publishing addresses associated with the North Korean hackers and calling on THORNode, RPC node operators, as well as instant exchange platforms and DeFi service providers to block transactions involved in the case.
Some protocols also began taking countermeasures.
- Symbiosis acknowledged that it detected funds involved in the case attempting to move through the protocol and contacted Binance.
- Although Relay has an address risk-screening mechanism, on-chain data still shows funds involved in the case being moved through the protocol
Among them, THORChain, the network to which the specifically named THORNode belongs, has long been controversial for repeatedly processing hacker funds.
From 2023 to 2026, THORChain generated a cumulative trading volume of about $9.27 billion and $12.47 million in fees across seven hacking or fraud incidents including FTX, Bybit, and Kelp DAO. Of this, the Bybit hack alone in 2025 generated about $8.63 million in fees.
In this Binance hack incident, THORChain once again became a cross-chain channel for the hackers. In response to the FBI's investigation request, co-founder Chad Barraford @CBarraford said that node data is already public and no subpoena is needed.
Dramatically, what ultimately caused THORChain to suspend most cross-chain transactions was not the FBI, but an anomalous 10 ETH refund. On October 31, an Ethereum block reorganization triggered the emergency pause mechanism, and as of November 1, related transactions on 10 chains including Bitcoin, Ethereum, and Tron were still affected.
Historical revelations: How does North Korea cash out stolen funds through OTC?
Judging from the past experience of North Korean hackers, cross-chain transfers are only part of the money laundering. Subsequently, mixers are usually used to increase the difficulty of tracing funds, and then underground OTC brokers are used to convert cryptocurrencies into fiat currency.
In April 2025, Bybit CEO Ben Zhou disclosed that about 28% of the stolen assets had become difficult to trace, with the relevant funds mainly passing through mixers and cross-chain bridges before ultimately flowing to P2P and OTC exchange channels.
In October of the same year, the Multilateral Sanctions Monitoring Team (MSMT), composed of 11 countries, further uncovered the off-chain cash-out network.
The investigation found that as of April 2025, North Korean personnel had arranged the cash-out of more than $100 million in Bybit stolen funds through a Hong Kong middleman. In addition, North Korea also cashed out at least $60 million in crypto assets through Russian middlemen, including some of the funds stolen from Bybit.
Cambodia's role was different. The investigation found that North Korean personnel cooperated with a North Korean national residing in Cambodia to transfer crypto assets into designated wallets, concentrate them in preparation for subsequent exchange, and then arrange cash-out through other regions including Hong Kong.
Similar operations had already appeared as early as 2018. That year, Lazarus stole about $250 million from an exchange and subsequently transferred about $91 million of it to two Chinese middlemen for processing. The U.S. Treasury later found that one of them had moved more than $34 million through bank accounts and had also converted some BTC into Apple iTunes gift cards.
As for this Binance hack incident, the hackers are still carrying out asset conversion, cross-chain transfers, and wallet splitting. But judging from past cases, North Korea possesses a relatively mature off-chain cash-out network.
Final thoughts
Over the past decade or so, the crypto industry has gone through several bull and bear cycles, and exchanges and DeFi protocols have been constantly replaced, but Lazarus has never stopped operating.
They do not care about market ups and downs, nor do they need to wait for a bull market. As long as there are still assets to steal, they will continue to look for their next target.
They may disguise themselves as job seekers, investors, partners, or even ordinary netizens who have chatted with you for months. A seemingly normal meeting invitation or a work document could become the starting point of an attack.
After all, you never know who is really on the other side of the screen talking to you. 
