A week after the largest theft in crypto history, part of the loot is starting to leave the blockchain. Chainalysis has traced stolen Binance funds into Chinese money-laundering networks, the channels North Korean hackers have used to cash out in previous thefts.

The amount tracked so far is in the hundreds of thousands of dollars, a fraction of the total. The attackers, identified by US authorities as North Korea's TraderTraitor group, are moving the rest through thousands of wallets across multiple blockchains to obscure its origin.

About $2.8B of the stolen assets had been frozen as of November 3, mostly stablecoins blocked by their issuers.

The remainder sits largely in assets like BTC and ETH that cannot be frozen. Once funds reach over-the-counter brokers and underground banking networks, recovery becomes far harder.