The $124 million that has been converted into Bitcoin should not be regarded as a separate amount, as the hackers just traded from one form of crypto to another. In this context, it is important to note that, according to Elliptic, only a small portion of the stolen money has been withdrawn.
How the laundering keeps moving
The stolen funds have been distributed through several transactions. According to Elliptic analysis, more than 20,000 crypto wallets have been traced alongside 16 different blockchains and 65,000 transactions. Although the activity seems to be automated, there is no evidence that AI agents are controlling it.
TRM Labs found that the hackers created tokens and liquidity pools on Tron to conceal transfers. They also moved funds through lending receipt tokens and connected blockchain bridges, bypassing wallets where assets might be frozen.
Earlier, Chainalysis tracked $325 million in stablecoins converted into $285 million of Ether within 20 minutes, apparently to avoid freezes.
Some $XRP conversions passed through THORChain. As Cryptopolitan reported, its website blocked flagged addresses following an FBI request, but independent nodes continued processing transactions.
Reopening withdrawals and the liquidity test
Binance is restoring withdrawals while the stolen funds remain in circulation. In a November 6 update, the exchange said it aimed to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of the following week.
Binance also reported replenishing 98% of the affected token assets by October 31. It pledged to cover customers’ losses, although replacing stolen assets does not mean recovering them.
The reopening has put Binance’s liquidity under pressure. Talos recorded $6.1 billion in net outflows. Bitcoin order-book depth within 1% fell 28% on the first day and reached a low around 44% below pre-hack levels near November 1 before recovering.
Bitcoin also dropped about 5% following the attack. However, Talos found limited signs of broader market contagion compared with the FTX collapse.
What it means for exchanges and compliance
The FBI attributed the theft to North Korea’s TraderTraitor group on October 31. It published addresses linked to the hackers and urged THORNode operators, DeFi services and instant exchanges to block related transactions.
Despite the sophisticated laundering, the attack began with familiar security weaknesses. Binance’s investigation described a fake job interview, malware installed on an engineer’s computer and the misuse of an internal AI tool. The attackers eventually gained access to systems involved in signing wallet transactions.
The breach highlights two challenges for exchanges: protecting employees and sensitive systems from intrusion, and stopping stolen funds from moving across decentralized networks.
Leave a Reply