North Korea's hacking organization is found to have suffered losses of about $119 million (approximately ₩160 billion) while hastily converting stolen crypto assets. The losses resulted from paying prices far above market rates in an attempt to avoid asset freezes. Conversely, traders and automated trading programs (bots) worldwide who detected this price distortion captured about $60 million (approximately ₩81 billion) in profits, net of transaction costs.
According to an on-chain analysis report released on the 9th by blockchain analytics firm Bitquery, the profits earned by counterparties during the North Korean hackers' conversion process following the recent Binance hack totaled $60 million. Roughly half of the hackers' losses flowed directly into the pockets of market participants.
The incident began on the 29th of last month. North Korean hackers withdrew a total of $6.3 billion (approximately ₩8.5 trillion) worth of Bitcoin, Ethereum, and other assets from Binance, the world's largest crypto exchange. Subsequently, major coin issuers such as Tether and Circle, along with related institutions, froze or recovered about $2.8 billion (approximately ₩3.8 trillion) in assets, putting the brakes on the hackers' fund movements.
As tracking intensified, the hackers flocked to decentralized exchanges (DEXs), which have no central controlling authority. On decentralized exchanges, prices spike when buying pressure surges all at once. When North Korea attempted to convert large volumes of altcoins into Bitcoin or Ethereum in a short period, prices on those trading venues temporarily diverged sharply from market rates. Bitquery analyzed that in some trades, the hackers paid prices about 16% above market rates. Other analyses suggest the divergence rate reached as high as 38%.
Traders' response to the price distortion was immediate. They bought coins at normal prices on regular exchanges and sold them back into the decentralized exchange venues where the hackers were paying premiums. This process was repeated tens of thousands of times through automated trading algorithms and individual traders. Bitquery identified such arbitrage trading as a major factor driving up the hackers' conversion costs.
Note: Compiled based on Bitquery's on-chain analysis report and publicly disclosed damage figures.
Despite the losses, the hackers' money laundering continues. They have disposed of most of the stolen Solana (SOL) and are continuing to convert XRP into Bitcoin. THORChain, a decentralized exchange network, is being used as a channel for dispersing assets.
According to global blockchain analytics firm Elliptic, North Korea converted approximately $90 million worth of Solana entirely into Bitcoin, then over the weekend began converting an additional approximately $100 million (approximately ₩130 billion) worth of XRP into Bitcoin. The remaining balance of stolen XRP is estimated at about $173 million (approximately ₩230 billion). The Bitcoin newly acquired through disposing of altcoins is reported to exceed 2,300 coins.
The laundering methods are also becoming automated and mechanized. They created 20,000 new wallets, generated more than 65,000 transactions, and are running a 24-hour automated laundering program. The approach obscures tracking by creating a new wallet every 30 seconds and moving coins every 10 seconds.
This case stands in stark contrast to the overall market mood. Amid a recent tech stock correction on the New York Stock Exchange and the fallout from the Binance hack, forced liquidations totaling $1.5 billion (approximately ₩2 trillion) occurred in the crypto market alone, and Bitcoin has been pushed down to the $75,000 (approximately ₩100 million) level, fluctuating near its yearly low. In a phase where most market participants are suffering losses, a criminal organization's rushed fund movements have served as a short-term source of liquidity for some traders.
Market observers see this case as exposing the structural vulnerabilities of decentralized exchanges. When large orders flood into pools with thin liquidity, prices are distorted in an instant, and in the process of automated arbitrage filling that gap, substantial profits are generated regardless of the nature of the original funds. At the same time, the fact that the hackers are consolidating assets into a single asset even at the cost of losses is interpreted as advance positioning aimed at evading tracking and cashing out later. The on-chain analytics industry is continuing its tracking efforts, focusing on fund flows through decentralized routes such as THORChain and the transaction patterns of newly created wallets.
