How Did North Korean Hackers Launder Money After the $6.3 Billion Theft? From Ronin and Bybit to the recent Binance hack, North Korean hackers have stolen billions of dollars from the cryptocurrency industry. Unlike ordinary hacker groups, Lazarus is believed to have close ties to the North Korean Reconnaissance General Bureau. US law enforcement has repeatedly stated that North Korea obtains foreign exchange through the theft of crypto assets and even funds weapons programs subject to international sanctions. Following the Binance hack, hackers launched another large-scale fund transfer. Combining the latest on-chain tracing and historical cases like Ronin and Bybit, we have outlined the money laundering path of North Korean hackers and how these stolen funds flow into the real financial system. Asset Exchange: Why Are Hackers Rushing to Sell Stablecoins? On October 29th, North Korean hackers stole approximately $6.3 billion from 17 Binance hot wallets, involving nine blockchains including Ethereum, Bitcoin, Tron, and Solana. Because the stolen assets included a large amount of centralized tokens such as USDT and USDC, the issuers had the authority to freeze them, and some L2 networks also retained emergency management authority, even allowing for the forced transfer of the assets. Therefore, after succeeding, the hackers quickly transferred the stablecoins to multiple intermediary wallets, simultaneously exchanging them for native assets such as ETH and TRX through DEXs. However, a large amount of assets remained untransferred. According to Bitquery, approximately $2.7 billion in assets were frozen or controlled by the issuers and related institutions, of which approximately $729 million in USDT was successfully transferred before the freeze. Cross-chain transfer: Which protocols did the funds flow through? After completing the first round of asset exchange, the hackers began using cross-chain protocols to transfer funds scattered across different networks to networks such as Ethereum and Bitcoin, and then further dispersed the funds through numerous new wallets. The funds on TRON were the most representative. The hackers first exchanged approximately $234 million USDT for 638 million TRX, then split it across multiple wallets and transferred it via at least six cross-chain protocols, including THORChain. Because these funds were continuously split and swapped during the cross-chain process, the vast majority ultimately converted into ETH on Ethereum. Funds on other blockchains underwent similar operations. For example: - Some assets on Base were transferred to Ethereum via Stargate, ultimately amounting to approximately 1,187 ETH. - Assets on Avalanche were first exchanged for USDC, then transferred to Ethereum via Circle CCTP, ultimately yielding approximately 7,243 ETH. Furthermore, the hackers selected cross-chain protocols such as Relay, Chainflip, and Symbiosis, based on the liquidity depth of different chains, to transfer funds in batches to reduce slippage caused by large exchanges. After the cross-chain transfer, the funds did not immediately enter exchanges but continued to be split into numerous new wallets. For example, a batch of ETH exchanged via THORChain was distributed to 35 addresses; another batch of funds transferred via Relay was exchanged for ETH via CoW Swap and then distributed to another 16 wallets. The entire process was highly automated. Elliptic found that the hacker's main TRON fund distribution wallet completed over 1,100 transfers between October 30th and November 1st, with the new addresses receiving funds typically transferring them out again within two minutes. Even if cross-chain transfers failed, some funds would re-apply for cross-chain transfers. FBI Calls for Interception, Cross-Chain Protocols React Inconsistently On October 31st, the FBI, in conjunction with the Secret Service and the IRS Criminal Investigation Department, issued a statement disclosing the addresses associated with the North Korean hackers and calling on THORNode, RPC node operators, instant exchange platforms, DeFi service providers, and others to block the transactions involved. Some protocols also began to take countermeasures. - Symbiosis acknowledged discovering attempts to transfer funds via a protocol and contacted Binance. - Although Relay has address risk screening mechanisms, the transfer of funds via this protocol could still be observed on-chain. THORChain, the network to which THORNode, specifically named by the FBI, belongs, has already been controversial due to its handling of hacked funds multiple times. From 2023 to 2026, THORChain generated approximately $9.27 billion in transaction volume and $12.47 million in fees in seven hacking or fraud incidents, including those involving FTX, Bybit, and Kelp DAO. In the 2025 Bybit theft alone, it generated approximately $8.63 million in fees. In this Binance theft, THORChain once again became a cross-chain channel for hackers. In response to the FBI's investigation, co-founder Chad Barraford (@CBarraford) stated that node data is already public and no subpoena is needed. Dramatically, it wasn't the FBI that ultimately caused THORChain to suspend most cross-chain transactions, but rather an unusual refund of 10 ETH. On October 31st, an Ethereum block reorganization triggered an emergency suspension mechanism, and as of November 1st, transactions on 10 chains, including Bitcoin, Ethereum, and Tron, remained affected. Historical Revelation: How Did North Korea Cash Out Stolen Funds via OTC? Past experiences of North Korean hackers suggest that cross-chain transfers are only one part of money laundering. They typically use mixers to further complicate fund tracing, and then utilize underground OTC merchants to exchange cryptocurrency for fiat currency. In April 2025, Bybit CEO Ben Zhou disclosed that approximately 28% of stolen assets were difficult to trace, with the funds primarily flowing through mixers and cross-chain bridges, ultimately ending up in P2P and OTC exchange channels. In October of the same year, the Multilateral Sanctions Monitoring Group (MSMT), comprised of 11 countries, further uncovered the off-chain fund transfer network. The investigation found that, as of April 2025, North Korean personnel had arranged for over $100 million in stolen Bybit funds to be cashed out through a Hong Kong intermediary. In addition, North Korea also cashed out at least $60 million in crypto assets through Russian intermediaries, including some of the stolen Bybit funds. Cambodia's role was different. The investigation found that North Korean personnel collaborated with a North Korean national residing in Cambodia to transfer crypto assets to designated wallets, preparing for subsequent exchange, and then arranging cash-outs through other regions, including Hong Kong. Similar operations had already occurred as early as 2018. That year, Lazarus stole approximately $250 million from an exchange and subsequently transferred approximately $91 million of it to two Chinese intermediaries for processing. The US Treasury Department later discovered that one of them transferred over $34 million through bank accounts and also converted some BTC into Apple iTunes gift cards. Regarding the recent Binance hack, the hackers are still engaged in asset swapping, cross-chain operations, and wallet splitting. However, based on past cases, North Korea possesses a relatively sophisticated off-chain withdrawal network. In Conclusion Over the past decade, the cryptocurrency industry has experienced several bull and bear markets, with exchanges and DeFi protocols constantly changing, but Lazarus has never ceased its activities. They don't care about market fluctuations, nor do they need to wait for a bull market. As long as there are assets to steal, they will continue to look for their next target. They might impersonate job seekers, investors, partners, or even ordinary online friends you've been communicating with for months. A seemingly normal meeting invitation or a work document could become the starting point for an attack. After all, you never know who is actually communicating with you on the other end of the screen.