DISCLAIMER: GoldInvestors.news is not a registered investment, legal or tax advisor or broker/dealer. All investment/financial opinions expressed by GoldInvestors.news are from the personal research and experience of the owner of the site and are intended as educational material. Although best efforts are made to ensure that all information is accurate and up to date, occasionally unintended errors and misprints may occur.

The hackers accused of stealing more than $6 billion from Binance now face a problem nearly as daunting as the theft itself: moving the crypto before investigators and platforms can trace, freeze, or recover it. Evidence cited in the report pointed to North Korean hackers, who allegedly drained accounts within minutes on Thursday.

Ilya Lichtenstein, a notorious hacker with direct experience in crypto theft and money laundering, told CNN that breaching an exchange may be easier than laundering the proceeds. He described stolen cryptocurrency as a highly visible liability that becomes harder to conceal as investigators close in.

Lichtenstein and his wife, Heather Morgan, pleaded guilty in 2023 to orchestrating a $4.5 billion money laundering scheme linked to the 2016 Bitfinex hack. He received a five year prison sentence in 2024 but was released early this January.

Lichtenstein now says he has changed sides and works as a “white hat” hacker seeking to prevent cyberattacks. Speaking about the Binance incident, he said attackers linked to North Korea typically search for the weakest point rather than directly targeting a heavily protected website.

That weak point could be an employee vulnerable to phishing or manipulation into downloading a virus, he said. For defenders, protecting the main entrance is not enough because every potential access point, including employees and connected systems, can become a target.

Once cryptocurrency begins moving, the first hours become critical. Lichtenstein compared the situation to the early stages of a murder investigation, explaining that stolen funds can be divided repeatedly into smaller pieces, shuffled among locations, and recombined.

AI agents can accelerate that process dramatically, allowing attackers to conduct complex movements at machine speed. The longer the activity continues, he said, the harder the funds become to trace, turning the response into an urgent contest between hackers and investigators.

Yet public blockchains leave a lasting record. Lichtenstein said sophisticated blockchain analysis tools can follow transactions, while some crypto platforms, including Tether/USD, can freeze funds and therefore are not completely decentralized.

Attackers must move quickly to obscure the trail, mix the stolen assets, and convert at least some of them before platforms intervene or authorities catch up. Each additional transaction creates another dangerous step where the stolen funds may be identified or stopped.

“They're holding a hot potato,” Lichtenstein said. He added that the hackers must try to exchange the crypto for legitimate money or mix it into funds where observers cannot distinguish the stolen assets from legitimate holdings.

“The hardest part is after the hack because there are a lot of eyes on all of that crypto, and you have to launder it very quickly before you get caught,” he said. His own method involved opening accounts at numerous exchanges with his identity, fake identities, and money mules.

Lichtenstein said he divided funds into smaller deposits and exchanged them for other cryptocurrencies through a process called “chain hopping.” Switching from one blockchain to another can disrupt the transaction trail, while multiple smaller transfers may be less likely to trigger money laundering controls.

AI now makes those methods faster and potentially more dangerous. Lichtenstein said models from OpenAI and Anthropic already possess advanced hacking capabilities, although safeguards and restricted access keep those systems under tight control.

He also pointed to open source models emerging from places such as China. While he said those models are not yet as advanced at hacking, he estimated that they may be only three to six months behind more capable systems.

That could put powerful hacking technology into far more hands. Lichtenstein warned that tools currently associated with nation state hackers could soon become available to an ordinary person able to download a model and operate it from a basement.

Lichtenstein called the consequences of crypto crime terrifying and said it was not worth the stress, damage, or lasting impact. Blockchain records remain available indefinitely, meaning improved technology may allow investigators to revisit old transactions and trace criminals years later.

CNN contacted North Korea’s mission at the United Nations regarding the allegations. Pyongyang has previously denied hacking allegations, while Binance said Saturday that it had covered 90% of the stolen customer funds and remained on schedule to resume withdrawals within its previously stated timeframe.

DISCLAIMER: GoldInvestors.news is not a registered investment, legal or tax advisor or broker/dealer. All investment/financial opinions expressed by GoldInvestors.news are from the personal research and experience of the owner of the site and are intended as educational material. Although best efforts are made to ensure that all information is accurate and up to date, occasionally unintended errors and misprints may occur.