Why didn't the North Korean hackers who stole $6.3 Billion from Binance convert any of it to Monero?

1. You can't freeze or seize eth without the private keys controlling that eth because it is a permissionless blockchain.

2. Stablecoins can be seized / frozen because they're smart contracts that can be arbitrarily updated, and they also depend on the issuer for redemption.

3. There's no permissionless way to swap to monero. Unstoppable swaps is a good idea but the market maker would refuse to trade. This is the whole thing that services keep claiming they can do when in reality they cannot (thorchain, waygu)

4. Even if they did accept that trade there is unlikely to be sufficient liquidity for that trade / there'll be MAD slippage.

1. Yes, I guess I was thinking that the ETH was held on Binance, where it 's wallet could be frozen, but I'm sure the ETH was moved into a private wallet.
2. Good info to know. Thanks for spelling that out for me.
3. I thought atomic swaps were permissionless. Who or what is the market maker you are referring to? Someone on Reddit commented that a $50 Million trade was accepted by Unstoppable Swap. If the trade was not able to be accomplished, then Unstoppable Swap wouldn't have accepted it, right?
4. Yes, thanks, I've learned that now, and learned a term I had never heard of before - slippage.

@ksilverstein
3. Unstoppable swap is non custodial, which puts it way ahead of 'swap services'. But its not permissionless because you need to find someone who will swap with you. This might be a 'market maker' who is available to swap on demand and makes money from the spread. In this case the hackers wouldn't have found someone who would want to swap monero for all that stolen crypto. The hackers only option is to find a service which cannot descriminate against the stolen funds. So whereas swapping to monero is a good option for the hackers, its also a difficult option.

@ksilverstein
puts on tinfoil hat
Whenever I see these incidents, my first question is was it really NK (or whatever badguy of the day) hackers, or is it someone else (here's looking at you CIA / NSA) as part of some op to demonize something, like maybe in this case DEX's. Not saying that is the case now or ever, but it can never be ruled out completely. Decentralized anything is a direct threat to the centralized goals of the powers who ought not be.

Monero’s daily trading volume is typically in the tens to low hundreds of millions of dollars (recent figures around $80–200 million), versus tens of billions for BTC/ETH and stablecoins. Moving even a fraction of the unfrozen haul into XMR would cause extreme slippage, require many small trades over an extended period, and risk drawing attention or failing to move the volume at usable prices. High-liquidity assets allow large, relatively efficient swaps.

Operational priorities of the group

TraderTraitor/Lazarus operations emphasize speed to escape freezes, use of familiar high-volume chains and DeFi tools, and integration with existing Chinese OTC/broker networks that handle BTC/ETH more readily for fiat or goods. Privacy is achieved through volume of transactions, bridges, peel chains, and mixers rather than a single privacy coin. They have used Monero in the past (especially for smaller amounts or mining), but it is not the preferred vehicle for multi-billion-dollar hauls.

Practical cash-out and utility

The end goal is usable value for the regime (weapons funding, sanctions evasion). BTC and ETH have deeper markets, more OTC counterparties, and established laundering pipelines. Monero’s stronger on-chain privacy is real but secondary when the bottleneck is moving and monetizing enormous sums without destroying market price or liquidity.