North Korean hacking groups have converted $124 million (~170 billion won) of the crypto assets stolen from Binance into Bitcoin and moved them to new wallets, according to blockchain tracking. Elliptic, the blockchain analytics firm, said in findings published on the 6th that roughly 1,650 BTC had been converted to Bitcoin as of that day, about double the amount from a day earlier. Much of the increase came from swapping XRP into Bitcoin.
Elliptic said 16 blockchains, more than 20,000 wallets and at least 36 services were mobilized for laundering after the Binance incident, with related transactions topping 65,000. Most of the stolen Solana (SOL) was sold or moved to other chains before ultimately ending up as Bitcoin, and XRP also began moving in earnest from the 5th, with about 42 million XRP ($50 million, ~68 billion won) drained and exchanged for Bitcoin.
Mixing operations to obscure the trail were also carried out. Since the 1st, about 33 BTC has been put through Wasabi-style coinjoins, and roughly $1.1 million (~1.5 billion won) worth of Ethereum (ETH) and Solana was routed through Privacy Cash. The platform reportedly blocked all new deposits outright during this process, a move seen as an effort to avoid the risk of being added to US sanctions lists once the inflow of stolen funds became known.
Total losses amount to $6.43 billion (~8.7 trillion won). Of that, about $2.85 billion (~3.9 trillion won) has been frozen, while about $3.11 billion (~4.2 trillion won) remains in hack-linked addresses. Elliptic said that because the core Bitcoin and Ethereum holdings have not yet moved, there is a possibility that Ethereum will be broken into small units, converted to Bitcoin and cashed out through over-the-counter (OTC) dealers.
Some analysts say operational control of the funds has passed to Chinese professional laundering networks. Elliptic assessed that the 18,270 BTC held in wallets was likely retained directly by North Korea, but that funds being split, mixed and moved in real time have already been handed to Chinese OTC broker organizations. These are "hwanchigi" brokers who convert crypto into cash without going through exchange ledgers, and North Korea used the same channel in last year's Bybit exchange hack.
The key point is that, unlike dollar-pegged stablecoins, Bitcoin is not subject to forced freezing by an issuing authority. Coins such as Tether can have accounts frozen by their issuers, but Bitcoin has no operating entity and is therefore used as a channel to circumvent sanctions networks. Elliptic assessed that this laundering proceeded faster than in previous cases, with operational control handed off quickly after the theft to begin real-time conversions.
Some market observers say the flow of large volumes of stolen assets concentrating into Bitcoin could weigh on short-term supply and demand. Others, however, take the view that direct impact on exchange prices will be limited, since most of the funds are cashed out through OTC channels. For exchanges and custodians, the compliance burden of verifying links to sanctioned addresses is bound to grow.
