The Wall Street Journal: The Hidden Crypto Money-Laundering Scheme: Who Is Helping North Korean Hackers Transfer Massive Funds from Binance?

Authors: Sam Kessler, Dylan Tokar

Translated by: TechFlow

TechFlow Summary: After more than $6 billion was stolen from Binance, nearly $3 billion remains in the hands of the hackers. THORChain and Wasabi Wallet continue to process related transactions and charge fees even after being specifically named by the FBI. This Wall Street Journal report puts the issue front and center: should protocols that claim to be "decentralized" be held responsible for money laundering? For readers holding relevant tokens and watching the regulatory trajectory of DeFi, this is the risk variable to watch most closely in the near future.

Illustration: EMIL LENDOF/WSJ, GETTY IMAGES

Last week, hackers pulled off the largest cyber heist in history, stealing more than $6 billion from the cryptocurrency exchange Binance. But for them, the job is just beginning.

According to blockchain analytics firm Chainalysis, the hackers launched an equally unprecedented money-laundering operation within minutes, dispersing the funds into more than 10,000 crypto wallets to move the ill-gotten gains beyond the reach of law enforcement and any crypto companies that might try to seize the funds or intercept the transfers.

On-chain analytics reveal that a cohort of cryptocurrency services, some operated by Americans, helped facilitate it all. Even after the U.S. Federal Bureau of Investigation (FBI) urged them to stop, these services continued to process transactions related to the theft and collected revenue from doing so.

The laundering operation has exposed a rift within the crypto industry: when criminals exploit this technology, who bears responsibility? Especially for decentralized services whose creators claim they are not controlled by any single individual.

According to Chainalysis data, one of those services, THORChain, processed over $46 million of the stolen Binance funds within 72 hours of the theft. The platform, which allows users to swap cryptocurrencies across different blockchains, has already collected more than $200,000 in fees from the hackers' transactions, revenue that goes to those helping run its infrastructure.

Chainalysis data also shows that over the same period, nearly $4 million underwent "coin mixing" through Wasabi Wallet. Wasabi Wallet features a function that allows users to hide the source of funds when transferring Bitcoin.

Developers of platforms like THORChain and Wasabi Wallet argue that they cannot intervene—or arguably should not intervene—when their protocols are exploited by bad actors. These bad actors include North Korea (which the FBI identifies as behind the Binance hack), as well as many others. (North Korea denies hacking Binance.)

"The biggest channel for North Korean money laundering is actually THORChain. They use the rhetoric of decentralization as cover, but in reality, it is highly centralized and generates substantial profits," said Nick Carlsen, a former FBI analyst and senior investigator at blockchain analytics firm TRM Labs.

"The protocol does not have the ability to screen individual transactions or individual wallets; that code simply does not exist," US co-founder of THORChain Chad Barraford said in a podcast this October.

Traditional financial institutions are bound by regulations that require them to screen for and report potential money-laundering activities. In the past, regulators have applied some of these rules to cryptocurrency companies.

But the decentralized finance space largely remains unregulated, even as scrutiny intensifies over its role in money laundering.

"Providing pathways to evade detection following vulnerability exploits, thefts, or hacks is almost like part of their business model," said Scott Armstrong, a former federal prosecutor who handled crypto cases and a partner at the law firm Armstrong & Bradylyons.

Critics question how decentralized these platforms really are. Federal prosecutors have filed lawsuits against operators of certain blockchain services, accusing them of knowingly helping criminals launder illicit proceeds, and have secured some convictions. Users are also seeking accountability.

Last year, investors in a lending protocol built on THORChain, created by Barraford and co-founder John-Paul Thorbjornsen, sued the two developers, questioning the protocol's claimed decentralization. The complaint alleges that Barraford and Thorbjornsen hold a master key that effectively functions as an "override switch" for the protocol. Investors claim Thorbjornsen even used this key to try to prevent the lending protocol from collapsing.

Barraford, who is based in the US, denied the investors' allegations. He did not respond to requests for comment regarding THORChain's use in the Binance theft.

Torbjornsen, a former Royal Australian Air Force pilot, posted on X telling the Wall Street Journal that he no longer plays an active role in THORChain. He stated that developers subsequently removed the administrator key at the center of the lawsuit, and the network is now run by 111 nodes (the number of operators was not disclosed), making it "far more decentralized" than other protocols.

Officially state-sponsored North Korean hacker groups have been behind most major crypto heists, and North Korea has a longstanding record of using THORChain to convert stolen funds into currencies such as Bitcoin.

After North Korean hackers stole $1.5 billion from the Dubai-based crypto exchange Bybit last year, the hackers completed nearly $1 billion worth of trades through THORChain. According to Chainalysis, this money laundering generated at least $12 million in fees for THORChain operators.

"All blockchain protocols earn fees based on usage," Thorbjornsen wrote in a message to the Wall Street Journal.

Many forces in the crypto industry have mobilized to help Binance recover the funds. Within hours of the incident, stablecoin issuers such as Tether and Circle blacklisted wallets associated with the theft, freezing roughly half of the stolen funds.

Yet, according to blockchain tracking firms, nearly $3 billion of the stolen funds remains in the hands of the hackers.

Those handling the funds immediately broke them into increasingly smaller tranches, weaving a spiderweb-like network of transactions that experts find difficult to trace. Along the way, the funds were moved back and forth between different blockchains and mixing services, where THORChain and Wasabi Wallet played their roles.

Over the weekend, the FBI called on cryptocurrency service operators to block activity related to the Binance hack, specifically naming THORChain's node operators. But the transfer machine known as THORChain kept right on operating.

Blockchain wallets linked to the Binance theft have also continued using Wasabi Wallet.

Wasabi Wallet uses a "coordinator" to allow users to transfer funds between Bitcoin wallets without leaving clear traces.

A platform tracking protocol data shows that currently, more than 99% of such transactions on Wasabi Wallet are handled by a single coordinator.

According to Chainalysis, the coordinator is an American Bitcoin developer using the pseudonym "Kruw," who earns negligible income from this work. He did not respond to recent requests for comment regarding this article.

In a public appearance in 2024, the developer stated that his support for the privacy platform stems from his ideological beliefs of "anarcho-capitalist libertarianism."

When asked if he worried about potential legal risks arising from this, he said he had "no interest in what politicians say or what regulators say," though he was fully aware of the risks involved.

"Am I safe? Am I protected by the U.S. Constitution?" he added. "No, we've seen that it doesn't always work."