North Korea Opens a New Wallet Every 25 Seconds to Launder $6.43B Binance Haul
Key Takeaways
- •North Korean hackers are laundering $6.43 billion stolen from Binance at an automated pace of approximately one new cryptocurrency wallet every 25 seconds.
- •In under four days, the stolen funds have been moved across roughly 12,000 wallet addresses spanning 11 separate blockchains.
- •The fragmentation of funds across thousands of addresses and multiple networks makes manual tracing impractical, requiring automated on-chain analysis to reconstruct the transfers.
- •Because every transaction settles on public blockchains, the laundering operation leaves permanent records that analysts can continue examining even as the campaign remains in motion.
- •United Nations and United States officials have tied North Korea-linked cyber units, including the Lazarus Group, to some of the largest exchange thefts on record, with proceeds said to fund the country's weapons programs.
North Korea Opens a New Wallet Every 25 Seconds to Launder $6.43B Binance Haul
North Korean hackers are laundering the $6.43 billion stolen from Binance at an automated pace that on-chain analysis puts at roughly one new cryptocurrency wallet every 25 seconds, according to reporting by COINOTAG published on November 2, 2026.
The speed of the operation is striking: in under four days, the attacker has pushed the stolen funds across approximately 12,000 wallet addresses on 11 blockchains. The near-continuous creation of fresh addresses points to a largely automated laundering process, with assets rapidly dispersed across multiple networks in ways that complicate efforts to trace their movement. Fragmenting funds across thousands of addresses — and across 11 separate networks rather than a single ledger — multiplies the number of transfers investigators must piece together, a pace of churn that manual review cannot realistically keep up with and that depends on the same automated on-chain analysis behind the 25-second estimate. The figures are a snapshot of a campaign still in motion at publication, but the trail itself is durable: because every hop settles on a public blockchain, each movement leaves a permanent record that analysts can continue to examine.
North Korea-linked cyber units have for years been tied by United Nations investigators and United States authorities to some of the largest cryptocurrency exchange thefts on record, including operations attributed to groups widely known as the Lazarus Group. Digital-asset theft has become a recognized source of revenue for the sanctioned country — proceeds that United Nations and United States officials have said help fund its weapons programs — and the scale of individual incidents has grown in recent years.
This content was first published on COINOTAG.
