North Korean hackers have laundered billions of dollars in cryptocurrency stolen from the exchange Binance, with Chinese brokers facilitating the conversion of the funds into usable currency to finance the regime's weapons programs, according to experts cited by The Post.
An estimated $6.3 billion in cryptocurrency was stolen from Binance, with approximately $3.3 billion remaining unfrozen. Investigators believe that after the initial rapid theft, which saw funds moved across 10 blockchains in about 20 minutes, Chinese money laundering teams took over the process.
"From that point on, it’s almost exclusively Chinese money laundering teams that are actually doing all of the transactions," said Nick Carlsen, an investigator at blockchain intelligence firm TRM Labs. The laundering operation reportedly used thousands of digital wallets in its initial days, with an average of one new wallet created every 25 seconds, according to blockchain analytics firm Elliptic. Despite the speed and complexity, the funds have not become untraceable.
The FBI has attributed the theft to North Korea's TraderTraitor operation. However, Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the accusations as a "grave political provocation" in a statement carried by state media.
The stolen funds represent a significant amount for North Korea, roughly equivalent to its recorded merchandise trade of $3.13 billion last year and more than a third of its estimated $17.2 billion GDP for 2024. These figures do not include the assets that were frozen.
"These massive inflows of hard currency go to the regime, allowing it to pursue its priorities," Carlsen told The Post. "Lately the highest priorities are weapons development and internal improvements."
Security experts note that North Korean hackers may not operate solely within the country, often blending their internet traffic with that of other nations. "We know that North Korean hackers have pitched up in China and been working from there," said Geoff White, author of "The Lazarus Heist."
Carlsen observed overlaps between the Binance laundering activities and a Chinese network previously involved in handling North Korean thefts. These financial intermediaries allegedly exchange cryptocurrency for yuan, which can be deposited into Chinese bank accounts or accessed via payment cards. "There’s this entire parallel banking system that allows the Chinese to access hard currency overseas, and that’s the networks the North Koreans hide their activity in," he explained.
White pointed to past cases, such as that of Nigerian Instagram influencer Ramon Abbas, known as Hushpuppi, who was convicted of working with North Korean hackers to launder money and facilitate fraud. U.S. prosecutors stated Abbas provided bank account details for a conspiracy to launder money from a heist attributed to North Korean hackers. He was sentenced to 135 months in U.S. prison in November 2022.
A 2023 prosecution also accused North Korean banker Sim Hyon Sop of collaborating with Chinese and Hong Kong traders to convert stolen cryptocurrency into dollar payments for goods for the regime, using front companies in Hong Kong. Another indictment alleged Sim and Chinese intermediaries procured a Russian helicopter for North Korean customers.
Carlsen suggested that apprehending the money launderers might be more feasible than capturing hackers protected by their home state. "From several past recent hacks we’ve identified Hong Kong and China-based individuals that are handling the laundering," he said. He added that cooperation from the Chinese government in cracking down on illicit banking activities would be crucial in preventing such operations. "If the Chinese government crack down on illicit banking, period, this would be basically impossible for the North Koreans," Carlsen stated.