North Korean Hackers Launder $172M in Crypto in Days

North Korean hackers, responsible for one of the largest crypto thefts, are rapidly laundering stolen assets, putting pressure on exchanges and regulators. The laundering of the remaining 156,500 ETH is expected to be completed within a few days, raising concerns about security protocols in the crypto industry.

The group has demonstrated an unprecedented level of operational efficiency in laundering stolen funds, according to a representative from TRM Labs. As of March 1, the North Korean hacking group has maneuvered an additional 62,200 ETH, valued at approximately $138 million, leaving only 156,500 ETH unlaundered from the original haul of 499,000 ETH.

Crypto investigator EmberCN indicates that at the current laundering velocity, funds could be entirely hidden from authorities in just a few days. Since the hacker resumed operations yesterday at 3 PM, they have successfully laundered 62,200 ETH valued at $138 million. With this swift progress, it is projected that the remaining 156,500 ETH (equivalent to $346 million) will be laundered within the next three days.

This aligns with insights from blockchain intelligence firm TRM Labs, which accurately described the attackers’ operational tactics as extraordinarily effective. The group has employed a sophisticated strategy that utilizes multiple intermediary wallets, decentralized exchanges, and cross-chain bridges to obscure the trail of stolen funds.

The FBI’s investigation has made significant strides. On February 27, they identified a North Korean hacking group, known as TraderTraitor, as the culprits behind the Bybit theft. In response to this alarming breach, Bybit has taken proactive measures by initiating a $140 million bounty program aimed at rewarding informants who assist in locating the stolen funds. So far, the initiative has compensated 16 individuals with a total of $4.2 million for their valuable intel.

Amid the auditors’ scrutiny, on-chain investigator ZachXBT has publicly criticized Circle, the issuer of the USDC stablecoin, for its slow response regarding the blacklisting of wallets associated with the hackers. He highlighted that Circle took over 24 hours to blacklist these wallets, providing the attackers with a critical window to further