North Korean hackers heisted $6.3 billion in cryptocurrency from Binance, roughly $3.3 billion stays unfrozen – but they need help laundering it.
For that they have Chinese brokers and middlemen who flip the loot into useable funds, which Kim Jong Un’s regime will undoubtedly spend on weapons and missiles, consultants instructed The Post.
“There’s not much to buy in Pyongyang. What North Korea wants to advance its missile program and its nuclear weapons development program is stuff that exists outside North Korea.
North Korean chief Kim Jong Un attends a assembly in Pyongyang in a photograph launched Oct. 24, 2026. Experts say Chinese brokers help his regime flip stolen crypto into spendable money. KCNA VIA KNS/AFP via Getty Images
“Stealing cryptocurrency gives North Korea a sort of international slush fund that it can move around the world without using banks, and it can pay people off, and buy the stuff that it needs,” Geoff White, writer of “The Lazarus Heist” which investigates North Korea’s hackers instructed The Post.
Chinese laundering crews are believed to have taken over after the hackers’ initial transfers within 20 minutes of the hack last week, according to Nick Carlsen, an investigator at blockchain intelligence firm TRM Labs.
The velocity of the theft was astonishing. Most of the Binance funds moved across 10 blockchains in about 20 minutes, according to TRM. Attackers then raced to swap belongings issuers were ready to freeze for unsanctioned cryptocurrencies beyond their control.
Nick Carlsen, proper, receives the FBI Director’s Award from Christopher Wray in 2017. He now tracks the money males serving to North Korea money out stolen crypto. Courtesy of Nick Carlsen
“From that point on, it’s almost exclusively Chinese money laundering teams that are actually doing all of the transactions,” he instructed The Post.
In its first three and a half days, the laundering operation then used about 12,000 digital wallets—roughly one new pockets every 25 seconds—according to blockchain analytics firm Elliptic. The transfers sophisticated monitoring but have not make the money untraceable.
The FBI blamed North Korea’s TraderTraitor operation for last Thursday’s $6.3 billion Binance theft — $3 billion of which was frozen before it could be transferred.
Kim Jong Un, middle proper, and his daughter, middle left, watch a drone exhibition in North Korea on Oct. 29, 2026. The FBI has blamed North Korean state-backed hackers for the $6.3 billion Binance theft. KCNA via KNS via AP
Binance has said it has set apart money to cowl any losses to its clients.
Dictator Kim Jong Un’s sister, Kim Yo Jong, rejected the accusation as a “grave political provocation” in a assertion carried by state media.
The theft was roughly equal to North Korea’s $3.13 billion in recorded merchandise commerce last yr, and more than a third of its UN-estimated $17.2 billion GDP for 2024. Those comparisons embody belongings subsequently frozen.
Carlsen said the stolen money provides to the regime’s coffers, serving to fund its spending priorities.
“These massive inflows of hard currency go to the regime, allowing it to pursue its priorities,” he instructed The Post. “Lately the highest priorities are weapons development and internal improvements.”
The security consultants pointed out North Korea’s hackers may not essentially be stationed in the nation, which helps operators mix into other nations’ web site visitors.
Kim Yo Jong, sister of North Korea’s chief Kim Jong Un, attends a wreath laying ceremony at Ho Chi Minh Mausoleum in Hanoi, Vietnam, March 2, 2019. She rejected the hacking accusation in a assertion by North Korean State media. REUTERS
“We know that North Korean hackers have pitched up in China and been working from there,” White said.
Carlsen said TRM had noticed overlap between the Binance laundering and a Chinese community handling earlier North Korean thefts. The money males work for a proportion, finally exchanging crypto for yuan in Chinese bank accounts or access to cost playing cards.
“There’s this entire parallel banking system that allows the Chinese to access hard currency overseas, and that’s the networks the North Koreans hide their activity in,” he said.
Raymond Abbas, identified as Hushpuppi, labored with North Korean hackers and ended up in US prison.
Author Geoff White, pictured with “The Lazarus Heist” and “Rinsed,” instructed The Post stolen crypto gives North Korea an “international slush fund” to finance purchases abroad.
White pointed out China’s restrictions on making abroad transfers has helped create demand for underground companies. From China, the laundered money will possible be moved again.
White pointed to Ramon Abbas, the Nigerian Instagram influencer identified as Hushpuppi, identified for flaunting luxurious clothes and his enviable life in Dubai.
“By night, he was working with all sorts of criminal elements including with North Korean hackers, to move money around to launder money and to facilitate fraud,” White said.
US prosecutors said Abbas equipped Romanian and Bulgarian bank-account particulars in a conspiracy to launder money from a Maltese bank heist attributed to North Korean hackers. Arrested in Dubai in June 2020, he was sentenced to 135 months in US prison in November 2022.
North Korean banker Sim Hyon-Sop, proven on a reward poster launched July 24, 2025, is accused of laundering stolen crypto to pay for items for Kim Jong Un’s regime. U.S. Dept of State
Carlsen sees more alternative in concentrating on the money males than catching hackers protected by their home state.
“From several past recent hacks we’ve identified Hong Kong and China-based individuals that are handling the laundering,” he said.
A 2023 prosecution accused North Korean banker Sim Hyon Sop of working with Chinese and Hong Kong merchants to convert stolen crypto into greenback funds for items for the regime, utilizing Hong Kong entrance firms.
Nick Carlsen, left, at the Demilitarized Zone in South Korea in 2003. He has spent his profession monitoring North Korea, from the Army to the FBI and now TRM Labs. Courtesy of Nick Carlsen
A separate indictment alleged Sim and Chinese intermediaries procured a Russian helicopter for North Korean clients in 2019. The contract listed a $300,000 price and supply to a North Korean port.
Carlsen said getting the funds back would only be potential with Chinese co-operation.
“If the Chinese government crack down on illicit banking, period, this would be basically impossible for the North Koreans,” he said. “But if they even just narrowly target the individuals handling these thefts, the North Koreans would be stuck with crypto assets that they can’t sell.”