FT Reports North Korea May Take Up to Several Years to Launder Stolen Binance Crypto

The British newspaper Financial Times (FT) reported on November 3 (local time) that it could take anywhere from several months to years for North Korean hackers to launder trillions of won worth of cryptocurrency stolen from the crypto exchange Binance.

According to the FT report and blockchain analysis firms, North Korean hackers have embarked on a long and complex laundering process, breaking down the stolen assets into smaller units and moving them across multiple paths to make tracing the fund flows difficult.

Initially, North Korean hackers stole 6.3 billion dollars (approx. 8.4 trillion won), but with some of those funds frozen, they currently control approximately 3.3 billion dollars (approx. 4.4 trillion won).

Regarding the laundering process of the stolen assets, Phil Larratt, senior director of global services at blockchain analysis firm Chainalysis, said, "This will take weeks, months, or perhaps years," adding, "They will sit on the funds for a long time and look for opportunities to cash out."

Jonathan Levin, co-founder of Chainalysis, said, "There is too much money for the hackers' trusted traditional laundering channels to handle," explaining that hackers are splitting the funds into smaller portions and sending them across a wide network of services.

The core of the laundering process involves decentralized finance (DeFi) lending platforms and cryptocurrency exchange services that swap one crypto asset for another.

Through this, hackers can convert the stolen cryptocurrency into other asset forms to make tracking even more difficult.

Because DeFi platforms are not subject to the same financial regulations as traditional banks, borrowers can borrow cryptocurrency without revealing their identities as long as they deposit sufficient collateral.

According to blockchain analysis firm Elliptic, just minutes after the asset theft, the hackers swapped 434 million dollars worth of the stablecoin Tether (USDT) for Ethereum (ETH) on a decentralized exchange, and deposited stolen USDT as collateral on a DeFi lending platform to borrow 45 million dollars worth of Ethereum.

This strategy exploits the fact that, unlike the stablecoin USDT—whose issuer can freeze assets—ETH has no central administrator and is difficult to freeze directly.

Previously, the U.S. Federal Bureau of Investigation (FBI) also identified the perpetrator of the Binance cryptocurrency theft as TraderTraitor, a known elite North Korean hacker group, announcing that it had "detected signs that TraderTraitor actors are converting the stolen assets primarily into Ethereum."

The FBI further projected that additional money laundering would take place through the conversion of the stolen cryptocurrency into other digital assets via DeFi and crypto exchange services.

TraderTraitor is the same group that the FBI identified as suspects when approximately 1.5 billion dollars was stolen from another cryptocurrency exchange, Bybit, last year.

In the final cash-out stage, over-the-counter (OTC) brokerages that are difficult to track are likely to be utilized.

Tom Robinson, co-founder of Elliptic, explained, "The funds are likely to be cashed out in a manner similar to the Bybit hack and past North Korean hacks, namely through OTC brokers centered around Chinese-speaking networks."
※ Please note: This article was translated by AI and may contain errors.