How stolen crypto is laundered, traced and frozen, step by step
What happens to crypto after a hack: how thieves split, swap, mix and cash out stolen funds, how investigators trace them, and when they get frozen.
Figures checked against 8 official and primary sources on . See the sources · How we check
Key points
- After a hack, thieves move fast: the FBI says the Bybit attackers converted stolen assets and spread them across thousands of addresses on multiple blockchains.
- Common steps are swapping freezable stablecoins for other assets, using mixers or privacy protocols, moving funds between blockchains and cashing out through over-the-counter traders.
- Public blockchains also make funds traceable. Investigators, analytics firms and exchanges follow the trail and can block or freeze funds when they reach a service that cooperates.
- The US Treasury has sanctioned mixers and OTC traders it says laundered North Korea's stolen crypto, and lists some addresses on its sanctions list.
In this guide
When crypto is stolen, the theft is only the first step. The thieves then need to hide where the money came from and eventually spend or cash it out. At the same time, investigators, exchanges and stablecoin issuers race to follow and freeze it. This guide explains both sides, using what the FBI, the US Treasury and blockchain analysts have described.
Why laundering is needed
Most major blockchains are public: anyone can see every transaction and the addresses involved. A thief can’t simply deposit stolen coins at a regulated exchange: OFAC expects crypto businesses to have compliance programs that include screening, and the addresses involved are often published. So the stolen funds go through a series of steps designed to blur the trail.
Step 1: move fast and split up
Speed matters, because every hour gives issuers and exchanges time to react. After the 2025 Bybit theft, the FBI said the attackers were “proceeding rapidly”, converting some assets to bitcoin and other assets dispersed across thousands of addresses on multiple blockchains.
TRM Labs described the same pattern after the Binance hack in October 2026, including a “peel chain” that split stolen bitcoin into round pieces to make the funds harder to follow.
Step 2: get rid of freezable tokens
Stablecoins such as USDT and USDC can be frozen by the companies that issue them. So thieves try to swap them for assets no issuer can freeze, such as ether or bitcoin. According to TRM, the Binance attacker sold USDT to market makers at a steep discount and borrowed ether against USDT on a lending protocol, while issuers froze about $2.67 billion. See how stablecoin issuers freeze stolen crypto.
Step 3: mixers and privacy protocols
A mixer pools funds from many users and pays them out to new addresses, making it hard to match deposits to withdrawals. The US Treasury has sanctioned several mixers it says laundered stolen funds:
| Mixer | Treasury action | What Treasury said |
|---|---|---|
| Blender | Sanctioned May 2022, the first mixer ever sanctioned | Processed over $20.5 million from the Axie Infinity-linked theft |
| Tornado Cash | Sanctioned August 2022; delisted March 2025 | Used to launder more than $7 billion since 2019, including over $455 million stolen by Lazarus Group and more than $96 million from the Harmony bridge theft |
| Sinbad | Sanctioned November 2023 | A “preferred mixing service” for Lazarus Group, used for the Horizon bridge and Axie Infinity thefts |
Other privacy tools are used too. The FBI says that in January 2023 the Harmony thieves used the privacy protocol RAILGUN to launder over $60 million in ether. For the legal side, see crypto mixers and sanctions.
Step 4: hop between blockchains
Moving funds from one blockchain to another through bridges and swap services adds another layer. TRM said it expects the next stage of the Binance laundering to involve cross-chain bridges, swap services and over-the-counter brokers. See crypto bridges explained.
Step 5: cash out
Eventually the funds need to become regular currency or goods. The FBI expected the Bybit assets to be “further laundered and eventually converted to fiat currency”.
The US Treasury says North Korea uses a network of over-the-counter (OTC) traders, including traders based in China, to convert crypto into fiat currency on its behalf, to avoid detection by financial institutions. In April 2023, it sanctioned two people it said did this for actors working with the Lazarus Group.
How investigators trace the money
The public nature of blockchains works against the thieves:
- Following the trail. Investigators and analytics firms track funds from address to address and across chains. TRM said it traced every transfer from Binance-attributed wallets to attacker-controlled addresses across ten blockchains.
- Publishing addresses. The FBI publishes addresses it says hold stolen funds, as it did after the Bybit and Harmony thefts, and asks exchanges, bridges, analytics firms and DeFi services to block transactions with them.
- Sanctions lists. OFAC can add crypto addresses to its sanctions list. It says its listings are “not likely to be exhaustive”, and that anyone holding crypto linked to a sanctioned person should block it and report it.
When funds get frozen
Freezes happen when stolen funds touch a company that can act:
- Stablecoin issuers can block addresses holding their tokens.
- Exchanges and other services can freeze deposits. The FBI says that after the Harmony theft, part of the laundered funds sent to crypto service providers was frozen in coordination with some of them.
- Some networks have emergency powers. TRM said Arbitrum’s Security Council moved about $30 million of the Binance attacker’s funds out of its reach.
Bitcoin and ether held in the thief’s own wallet can’t be frozen this way. See can a crypto transaction be reversed?
What it means for you
- Don’t accept crypto from strangers or unusual sources. Funds linked to a theft can be frozen when they reach an exchange.
- Don’t buy “discounted” crypto offered privately after a big hack.
- If you’re worried about funds you received, keep records and tell your exchange. In the US, OFAC rules require blocking property of sanctioned persons.
- If you’ve lost crypto, report it quickly with full transaction details. See how to report crypto scams.
Frequently asked questions
Can stolen crypto be traced?
Why do hackers use mixers?
How do hackers turn stolen crypto into cash?
Why does stolen crypto get frozen?
Could I end up holding stolen crypto by accident?
Sources
- North Korea Responsible for $1.5 Billion Bybit Hack (PSA, 26 February 2025) — FBI, Internet Crime Complaint Center
- FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft (23 January 2023, updated 6 February 2023) — Federal Bureau of Investigation
- Treasury Targets Actors Facilitating Illicit DPRK Financial Activity in Support of Weapons Programs (24 April 2023) — US Department of the Treasury
- U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (8 August 2022) — US Department of the Treasury
- Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency (Sinbad, 29 November 2023) — US Department of the Treasury
- Tornado Cash Delisting (21 March 2025) — US Department of the Treasury
- OFAC FAQs on digital currency (560, 562, 594 and 646) — Office of Foreign Assets Control
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (29 October 2026) — TRM Labs
First published . Spotted an error or an outdated figure? Tell us and we will check it against the source.
