North Korea’s record-breaking $6.4 billion cryptocurrency theft has so far produced remarkably little spendable money, despite the enormous scale of the attack. With billions already frozen and much of the remaining cryptocurrency under surveillance, investigators believe Pyongyang may turn to Chinese money-laundering networks to convert the stolen assets into usable funds.
The Oct. 29 cyberattack against Binance, the world’s largest cryptocurrency exchange, was the biggest cryptocurrency theft ever recorded. The FBI has attributed the operation to TraderTraitor, a hacking group linked to North Korea’s military, although Pyongyang denies responsibility.
According to a Nov. 13 analysis by blockchain intelligence firm Elliptic, approximately $2.85 billion of the stolen assets has been frozen, while another $2.8 billion remains in cryptocurrency addresses associated with the theft.
Most importantly, Elliptic concluded that only a negligible amount of the stolen cryptocurrency has likely been converted into conventional, spendable money.
For the best of our weekly content！
You are now signed up for our newsletter
Check your email to complete sign up
Billions stolen, but little money available to spend
The financial consequences for North Korea could be substantial. Although its hackers successfully removed more than $6 billion from Binance, stealing cryptocurrency and converting it into usable funds are two very different operations.
Elliptic’s latest assessment states: “A negligible amount has likely been cashed out so far.”
On Nov. 12, the U.S. Department of Justice announced that American authorities had obtained court authorization to seize or restrain more than $1.2 billion of the stolen assets. That amount forms part of the more than $2.7 billion frozen through coordinated government and private-sector efforts.
Assistant Attorney General A. Tysen Duva credited investigators with “immediately freezing billions of dollars’ worth of stolen Binance digital assets” before the hackers could move them beyond law enforcement’s reach.
Blockchain investigators at Elliptic subsequently confirmed that approximately 44 percent of the original $6.43 billion theft had been frozen or seized.
The hackers retain control of substantial cryptocurrency holdings, including Bitcoin and Ethereum, which cannot be frozen by a central issuer. However, converting those holdings into conventional currency creates another opportunity for investigators to identify and intercept the money.
Despite transferring assets through almost 27,000 wallets across at least 16 blockchains, North Korea’s operatives have yet to demonstrate that they can successfully cash out any substantial portion of the proceeds.
Investigators have identified approximately $285 million in stolen cryptocurrency converted into Bitcoin. However, those transactions represent exchanges between digital assets rather than withdrawals into conventional currency.
The result is an unusual situation in which North Korea controls cryptocurrency worth billions of dollars but has not yet demonstrated that it can convert much of that wealth into money available for purchases, foreign transactions, or financing government operations.
Chinese money-laundering networks may hold the key
The next phase of the operation could depend heavily on underground financial networks connected to China.
According to Elliptic, North Korea has previously relied on Chinese money-laundering organizations to move stolen cryptocurrency through intermediaries capable of exchanging digital assets for conventional currency.
The firm’s Nov. 13 analysis warned that some of the proceeds currently being laundered “may already be with Chinese money laundering networks.”
However, investigators have not established whether Chinese intermediaries have received funds from the latest Binance attack. Blockchain records can reveal where cryptocurrency moves without necessarily identifying who controls the receiving wallets.
The suspected laundering mechanism involves over-the-counter cryptocurrency brokers, commonly known as OTC brokers. These intermediaries can arrange private cryptocurrency transactions outside conventional exchanges, potentially helping sanctioned entities obtain foreign currency or purchase goods through intermediaries.
The importance of Chinese financial networks to North Korea is already documented by American authorities.
In a December 2024 sanctions announcement, the U.S. Treasury Department identified a money-laundering network involving Chinese nationals Lu Huaying and Zhang Jian, who allegedly helped convert illicit North Korean cryptocurrency proceeds into conventional currency.
The department also identified Sim Hyon Sop, a North Korean banking representative operating from China, as an organizer of financial networks used to disguise and transfer illicit funds.
According to the U.S. Treasury Department, Chinese national Lu Huaying converted illicit North Korean cryptocurrency into cash on behalf of Sim Hyon Sop, with the proceeds subsequently used to purchase goods and services believed to be destined for North Korea or its proxies.
These findings establish a precedent for how Pyongyang can use overseas intermediaries to transform stolen digital assets into practical financial resources.
Elliptic expects a similar pattern to emerge following the Binance theft, with the hackers gradually converting Ethereum holdings into Bitcoin before attempting to exchange the proceeds through private brokers and cryptocurrency exchanges.
The process could take months, particularly because the FBI has publicly identified wallets associated with the theft and urged cryptocurrency businesses to block transactions involving the stolen assets.
For North Korea, the distinction is critical. Cryptocurrency sitting in an identifiable digital wallet may represent enormous potential wealth, but it does not necessarily provide the foreign currency needed to circumvent sanctions or finance international purchases.
Original article
Comments