North Korea-Linked Launderers Move $430K From Binance Hack

By Nathan Brooks

North Korea-linked actors moved about $430,000 in stolen Binance funds through homemade memecoins, while a separate laundering operation sent roughly 7,000 ETH, worth about $15 million, into Tornado Cash, according to Elliptic.

The wider theft followed an Oct. 29 attack on Binance, which the FBI attributed on Oct. 31 to North Korea's TraderTraitor group. Binance put the breach impact at $6.34 billion and said it has set aside more than the full amount to cover losses.

Elliptic's tracker, updated Nov. 9 at 13:15 UTC, maps stolen funds across more than 20,000 wallets on 16 blockchains, touching at least 36 services and roughly 65,000 transactions. Since Nov. 8, theft-linked wallets have deposited about 7,000 ETH, valued near $15 million, into Tornado Cash.

Some of those deposits originated from bitcoin that had already passed through coinjoin transactions before conversion back into ether.

The laundering routes

The memecoin route is a small slice of a much larger operation, and the playbook predates this theft. Elliptic identified the same technique after the 2025 Bybit hack, where cheaply created tokens helped delay investigators because the tokens could simply be discarded afterward.

The firm said investigators could still follow the trail on-chain and cautioned that “funds arriving from a liquidity pool” should not be treated as clean by default. The memecoin flow is less than 0.01% of Binance's reported $6.34 billion impact.

The tracker also shows around 3,000 BTC, worth roughly $225 million, accumulating in newly created addresses after conversions from other stolen assets. The main Bitcoin and Ether holdings had not moved.

Approximately $3 billion remains in theft-linked addresses, and $2.85 billion is frozen—roughly 95% of that tracked balance. Only a negligible amount is likely to have been cashed out.

On Oct. 31, the FBI attributed the theft to TraderTraitor and urged services, including THORChain operators, to “block linked transactions.” The hackers had also used THORChain to convert stolen assets into bitcoin, an asset that no central issuer can freeze.

How the intrusion unfolded

Binance's Nov. 3 post-mortem describes a months-long intrusion built on fake recruitment interviews and tampered developer software. During a September interview process, an engineer downloaded an assignment repository onto a work computer, where malicious code replaced a legitimate development tool without triggering endpoint security.

On Oct. 20, the attacker used that machine and an internal AI tool to reach two wallet engineers' computers. Stolen container deployment credentials then provided access to wallet-signing operations.

Blockaid's technical findings identified 50 EIP-7702 authorizations submitted in a single transaction, covering consecutive counter values of the actively used wallet.

Binance characterized the root cause as endpoint compromise through a poisoned development tool rather than a leaked private key. That places the remediation burden on operational security instead of key rotation, a distinction with consequences for software suppliers, exchanges and employee devices.

What does this change for compliance teams?

For compliance teams, the practical change is that a liquidity-pool deposit cannot serve as evidence of clean ownership. The observed laundering routes use disposable memecoins, coinjoin-processed bitcoin and conversions through services such as THORChain, so screening must follow asset history rather than rely on the token or wallet label.

That imposes a higher monitoring burden than checking whether an address has interacted with a known mixer or token. A service should not assume that a transfer is clean because it reached Tornado Cash indirectly through another chain or asset. Elliptic's finding gives investigators the counterweight: public ledgers retain the path from memecoin-pool creation to the Tornado Cash deposits.

Obstruction slows tracing but does not erase it. The practical result is additional case work for compliance staff and a need to resolve links before treating the funds as lawful, rather than assuming that each hop starts a fresh ownership history.

Recovery now turns on governance

Binance has frozen 8,425.997 ETH and 74.56 million ARB on Arbitrum, and those balances can move again only with DAO approval. Binance estimates that the process will take seven weeks or longer.

Recovery therefore depends on governance timelines as much as on investigative work. A DAO vote governs the Arbitrum balances, while the FBI's request for transaction blocking extends the enforcement burden to other services, including THORChain operators.

Bitget provides live spot and futures prices for market monitoring, while the recovery pipeline in this case runs through governance, freezes and tracing. The binding constraints are endpoint remediation, cross-service enforcement and approval of the funds still held under DAO control.

The next concrete checkpoint is the Arbitrum DAO process, which Binance expects to take seven weeks or longer; until those approvals and enforcement actions align, recovery remains constrained by institutional timelines as much as technical tracing.