North Korean hackers are moving the roughly $6.4 billion stolen from Binance at a blistering clip, creating a new cryptocurrency wallet approximately every 25 seconds, according to blockchain analytics firm Elliptic, which published its analysis of the laundering campaign on Monday.

In under four days, the attacker has dispersed the funds across about 12,000 wallets spanning 11 blockchains, executing more than 40,000 transactions in the process. Elliptic described the operation as highly automated but said it found no evidence of artificial intelligence at work.

Stablecoin issuers, however, moved faster than the thieves could spread the money. Roughly $2.85 billion, or 44% of the haul, has been frozen or seized — a marked contrast to the approximately 3% frozen following North Korea's $1.5 billion hack of Bybit in February 2025, which had stood as the largest cryptocurrency theft on record. The Binance breach is more than four times that size.

Speed proved critical because stablecoins made up $3.46 billion, or 54%, of the stolen funds, and their issuers retain the ability to freeze them. Tether locked the stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet, while Circle froze all $823 million in stolen USDC before any of it could be swapped, Elliptic found.

Before those freezes took effect, the hacker converted 434 million USDT into ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on the lending protocol Aave against another 59.9 million USDT, and traded 234 million USDT for Tron's TRX token. In total, about $786 million in stablecoins escaped the issuers' intervention.

The breach itself began late Thursday, when attackers started draining Binance's hot wallets — internet-connected wallets exchanges use to process customer withdrawals, which makes them the most exposed layer of an exchange's custody stack. The FBI has since attributed the theft to TraderTraitor, a North Korean state-linked hacking group that U.S. authorities have previously tied to other major cryptocurrency thefts, and published hundreds of linked addresses. Binance, which has pledged to cover all customer losses, reopened withdrawals on Sunday and recorded about $3.64 billion in net outflows during the first nine and a half hours.

The laundering that followed has been relentless. Tron became the primary conduit, with transaction activity peaking at around 1,300 transfers in a single hour. The pace fueled speculation that AI agents were orchestrating the movement, but Elliptic rejected that interpretation, citing fixed timing, set amounts, blind retries, and pauses that resemble human working hours. While the laundering is clearly automated, the firm wrote, “nothing we have seen shows an AI agent making decisions.”

Substantial sums remain untouched. About $3.24 billion sits in addresses linked to the theft, mostly in ETH and the 18,270 stolen Bitcoin, which have not moved since the day of the attack. Elliptic believes those funds are very likely still held by North Korea — United Nations investigators have previously reported that North Korean crypto thefts help fund the country's weapons programs — while money already moving through the laundering pipeline may have passed to Chinese money-laundering networks. Only a negligible amount appears to have been cashed out. Roughly $16 million has also flowed to addresses holding proceeds from September's Bitget exploit.

Drawing on the playbook observed after the Bybit hack, Elliptic expects the attacker to swap its ETH for Bitcoin in small batches and cash out through over-the-counter brokers over a period of months. Further freezes will be more difficult to secure, the firm said, because ETH and Bitcoin cannot be frozen. The best remaining opportunities lie with centralized services, where the funds will eventually have to surface — and where the FBI's hundreds of published addresses give compliance teams a concrete screening tool.

The Binance theft caps a punishing stretch for the crypto sector's security posture. BTCPay Server urged merchants to switch off their servers on Monday amid reports of hot wallet attacks, and Brazilian exchange Mercado Bitcoin halted withdrawals after a $40 million hack. It remains unclear whether either incident is connected to the Binance attack.