Pyongyang has fiercely rejected allegations linking it to the colossal $6.3 billion Binance hack, with senior official Kim Yo Jong — sister of leader Kim Jong Un — branding the accusations a “grave political provocation.” This denial comes as blockchain analytics firms continue their intricate work of tracing billions in pilfered cryptocurrency across a vast and complex digital labyrinth.
Kim Yo Jong, as reported by Yonhap citing the state-run Korean Central News Agency, denounced the FBI's direct attribution of the attack to the North Korea-linked hacking group known as TraderTraitor. She accused Washington of deliberately misleading international public opinion and portraying all global cybercrimes as the handiwork of North Korea.
Despite Pyongyang’s strong denial, leading blockchain intelligence firms, including Elliptic and Chainalysis, have consistently linked the sophisticated cyberattack and the subsequent movement of the stolen funds to North Korean actors. These firms highlight the increasingly complex techniques employed by the hackers to obfuscate their digital trail.
Elliptic's recent report detailed the extraordinary scale of the laundering operation in its initial stages. Within just four days post-attack, hackers utilized approximately 12,000 unique wallets across 11 different blockchains, executing over 40,000 transactions. This activity, observed as highly complex and automated, saw a new wallet deployed roughly every 25 seconds.
Initial laundering efforts were concentrated on the Tron blockchain, where the stolen funds were dispersed across an estimated 7,700 addresses before being funnelled to Ethereum via cross-chain bridges. Over $147 million alone was transferred out of Tron this way. The hackers also leveraged decentralized exchanges to convert stolen stablecoins into less traceable cryptocurrencies like Ether, thwarting attempts by issuers such as Tether and Circle to freeze assets, though about $786 million in stablecoins was converted before remaining assets were frozen.
The laundering network has since expanded, reaching other significant blockchains, including Solana. Chainalysis confirmed that North Korea-linked actors initiated a new phase of laundering after moving more than $500 million through intermediary wallets on Tron. Elliptic also reported the emergence of bitcoin mixing, a technique designed to obscure transaction history, with approximately 28 bitcoin (worth $2.2 million) passing through 18 mixing transactions.
Despite the extensive and agile movement of funds, significant progress has been made in recovering or freezing a substantial portion of the stolen assets. About $2.85 billion, equating to 44% of the exact $6.43 billion reported stolen by Elliptic, has been secured. Roughly $3.24 billion, predominantly in Bitcoin and Ether, remains in addresses linked to the theft. Importantly, analysts note that only a negligible amount of the stolen funds appears to have been cashed out, with most activity involving transfers or conversions between cryptocurrencies.
Elliptic suggests that the laundering operation has progressed slower than observed in previous major hacks, such as the $1.5 billion Bybit incident in February 2025, where all stolen Ether was moved within 10 days. Experts anticipate the remaining funds will be gradually converted into Bitcoin and eventually cashed out through over-the-counter brokers and exchanges over several months.
Separately, Binance announced it is progressively reopening withdrawals for additional crypto assets across more networks, expanding its phased restoration of services. The exchange also affirmed it has covered about 95% of the affected amount, with ongoing efforts to acquire the remaining less liquid tokens in collaboration with industry partners.
