North Korea launders Binance hack loot, opening a new wallet every 25 seconds

Decrypt said the actors have opened about 12,000 wallets, freezing $2.85bn of the $6.43bn stolen, while only a few percent of the Bybit hack loot has been recovered.

By Divyansh Mishra, YourKhabri DeskNov 2, 2026, 08:42 PM UTC1 min readNorth KoreaBinancecrypto launderinghack

Key takeaways

1$2.85bn of the $6.43bn stolen from Binance has been frozen or seized
2North Korean actors have opened about 12,000 wallets, averaging a new one every 25 seconds

Decrypt reported on Wednesday that North Korean hackers are laundering stolen Binance funds by creating a new wallet approximately every 25 seconds, a pattern that emerged after the $6.3bn breach at the exchange in October.

The report said the operation spans about 12,000 wallets and has resulted in $2.85bn being frozen or seized, compared with roughly 3 percent of the Bybit hack loot that authorities have recovered so far.

Binance is the world’s largest cryptocurrency exchange by trading volume, handling billions of dollars daily. The breach, disclosed in October 2026, was the biggest crypto theft on record and prompted Tether to freeze $971m in USDT and Thorchain to pause bridges handling $2.5bn. YourKhabri’s earlier tracking showed the loot being shifted onto Solana after an initial $500m extraction from Tron wallets. Binance’s native token BNB, with a market cap above $50bn, is a key asset on the platform.

The rapid creation of wallets shows how hard it is for regulators to trace illicit crypto flows and suggests North Korean groups will keep using automated laundering tools. Observers will watch for further seizures by authorities and any tightening of anti-money-laundering controls on cross-chain bridges, while investigators aim to target the laundering infrastructure and coordinate with international law-enforcement agencies.

Also reported by

Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.