North Korea's Binance hack playbook from Bybit (Feb 2025) is now completely dead. Here's the technical breakdown:

Bybit Feb 2025: 400K+ $ETH stolen, 30% laundered by day 5, over 50% by day 7, done in 10 days. Exit routes: THORChain (ETH→BTC), eXch, OKX Web3 DEX aggregator.

What killed those exits:
• eXch: shut down April 2025 (DOJ whistleblower, transatlantic op)
• OKX DEX aggregator: paused, relaunched with real-time abuse detection + blocking
• THORChain: FBI pressing node operators directly, swaps went dark
• FBI response time: Bybit address list out in 5 days. Binance hack: 600+ addresses flagged within days.

Onchain proof (Nov 2):
Bybit hacker day 5: ~30% washed
Binance hacker day 4:
• 522,409 $ETH in 8 wallets, 0 transactions
• 18,270 $BTC, 0 sats moved
• $161M in wBETH, XAUt, USD1, PAXG untouched
Laundered from main stash: 0%

They're scraping crumbs on Tron and Solana while $2.8B sits frozen, fully visible, fully watched.

Binance reopened withdrawals, processed $3.64B net outflows, 95% impact covered.

Users whole. Thieves stuck. Every door they used in Feb has a guard now. 🔶