North Korean hackers have begun a second round of laundering virtual assets stolen from Binance. [Reuters]
North Korean hackers have begun a second round of laundering virtual assets stolen from Binance. [Reuters]

North Korean hackers have begun a second round of laundering funds stolen from Binance, the world's largest cryptocurrency exchange, blockchain analytics firms confirmed.

According to Chainalysis and LookOnChain, the hackers began emptying temporary wallets used to store the stolen virtual assets and moving the funds to other blockchain networks, including the Solana network, on Monday (local time). The firms also found evidence that the hackers are converting 970,522 Solana tokens — worth about $96.5 million — into bitcoin.

"North Korea-linked actors have begun a new laundering phase for funds stolen from Binance," Chainalysis said. After moving the stolen funds into temporary wallets under their control, the group has now entered a second laundering stage, the firm said.

The hackers appear to be routing the stolen assets through temporary wallets they control before transferring them to other blockchain networks such as Solana, making the funds harder to trace. Analysts said the group is further obscuring the trail by conducting more than 3,000 transfers across more than 1,000 wallets in repeated cycles.

Stablecoins and altcoins issued by identifiable entities carry the risk of being frozen or blocked even after theft. The hackers therefore appear to be converting the funds into bitcoin — a decentralized cryptocurrency with no controlling authority that can freeze it. Bitcoin also offers the greatest liquidity when converting to cash.

"As of Monday, more than $1 billion in ether and $1.42 billion in bitcoin stolen from Binance remain in a state of limited onward movement," Chainalysis said. "The activity observed immediately after the hack is consistent with an early laundering phase focused on isolating and dispersing the funds."

The laundering methods also include a circular pattern in which funds pass through multiple transfers before returning to wallets they had already passed through — a technique analysts believe involves automated algorithms designed to paralyze tracking efforts.

After completing the second laundering stage, the group is expected to move into a third phase, breaking the funds into smaller amounts and converting them into physical currencies such as the US dollar for final extraction.


kate01@heraldcorp.com