North Korean hackers heisted $6.3 billion in cryptocurrency from Binance, roughly $3.3 billion remains unfrozen – but they need help laundering it.
For that they have Chinese brokers and middlemen who turn the loot into useable funds, which Kim Jong Un’s regime will undoubtedly spend on weapons and missiles, experts told The Post.
“There’s not much to buy in Pyongyang. What North Korea needs to advance its missile program and its nuclear weapons development program is stuff that exists outside North Korea.
“Stealing cryptocurrency gives North Korea a sort of international slush fund that it can move around the world without using banks, and it can pay people off, and buy the stuff that it needs,” Geoff White, author of “The Lazarus Heist” which investigates North Korea’s hackers told The Post.
Chinese laundering crews are believed to have taken over after the hackers’ initial transfers within 20 minutes of the hack last week, according to Nick Carlsen, an investigator at blockchain intelligence firm TRM Labs.
The speed of the theft was astonishing. Most of the Binance funds moved across 10 blockchains in about 20 minutes, according to TRM. Attackers then raced to swap assets issuers were able to freeze for unsanctioned cryptocurrencies beyond their control.
“From that point on, it’s almost exclusively Chinese money laundering teams that are actually doing all of the transactions,” he told The Post.
In its first three and a half days, the laundering operation then used about 12,000 digital wallets—roughly one new wallet every 25 seconds—according to blockchain analytics firm Elliptic. The transfers complicated tracking but have not make the money untraceable.
The FBI blamed North Korea’s TraderTraitor operation for last Thursday’s $6.3 billion Binance theft — $3 billion of which was frozen before it could be transferred.
Binance has said it has set aside money to cover any losses to its customers.
Dictator Kim Jong Un’s sister, Kim Yo Jong, rejected the accusation as a “grave political provocation” in a statement carried by state media.
The theft was roughly equal to North Korea’s $3.13 billion in recorded merchandise trade last year, and more than a third of its UN-estimated $17.2 billion GDP for 2024. Those comparisons include assets subsequently frozen.
Carlsen said the stolen money adds to the regime’s coffers, helping fund its spending priorities.
“These massive inflows of hard currency go to the regime, allowing it to pursue its priorities,” he told The Post. “Lately the highest priorities are weapons development and internal improvements.”
The security experts pointed out North Korea’s hackers may not necessarily be stationed in the country, which helps operators blend into other countries’ internet traffic.
“We know that North Korean hackers have pitched up in China and been working from there,” White said.
Carlsen said TRM had observed overlap between the Binance laundering and a Chinese network handling earlier North Korean thefts. The money men work for a percentage, eventually exchanging crypto for yuan in Chinese bank accounts or access to payment cards.
“There’s this entire parallel banking system that allows the Chinese to access hard currency overseas, and that’s the networks the North Koreans hide their activity in,” he said.
White pointed out China’s restrictions on making overseas transfers has helped create demand for underground services. From China, the laundered money will likely be moved again.
White pointed to Ramon Abbas, the Nigerian Instagram influencer known as Hushpuppi, known for flaunting luxury clothing and his enviable life in Dubai.
“By night, he was working with all sorts of criminal elements including with North Korean hackers, to move money around to launder money and to facilitate fraud,” White said.
US prosecutors said Abbas supplied Romanian and Bulgarian bank-account details in a conspiracy to launder money from a Maltese bank heist attributed to North Korean hackers. Arrested in Dubai in June 2020, he was sentenced to 135 months in US prison in November 2022.
Carlsen sees more opportunity in targeting the money men than catching hackers protected by their home state.
“From several past recent hacks we’ve identified Hong Kong and China-based individuals that are handling the laundering,” he said.
A 2023 prosecution accused North Korean banker Sim Hyon Sop of working with Chinese and Hong Kong traders to convert stolen crypto into dollar payments for goods for the regime, using Hong Kong front companies.
A separate indictment alleged Sim and Chinese intermediaries procured a Russian helicopter for North Korean customers in 2019. The contract listed a $300,000 price and delivery to a North Korean port.
Carlsen said getting the funds back would only be possible with Chinese co-operation.
“If the Chinese government crack down on illicit banking, period, this would be basically impossible for the North Koreans,” he said. “But if they even just narrowly target the individuals handling these thefts, the North Koreans would be stuck with crypto assets that they can’t sell.”
