North Korea Denies Binance Hack Role Amid Billions in Crypto Traced

North Korea has officially denied any involvement in the hacking incident that led to the theft of an estimated $6.3 billion from Binance, one of the world's largest cryptocurrency exchanges. The accusation, which was made public by the FBI and blockchain security firms, was described by Pyongyang as a "grave political provocation," according to the state-run Korean Central News Agency (KCNA).

Kim Yo Jong, the sister of North Korean leader Kim Jong Un, directly addressed the allegations, condemning the FBI's claim that a hacking group known as TraderTraitor, allegedly linked to North Korea, orchestrated the attack. She accused the United States of manipulating global opinion by portraying North Korea as a cybercriminal state, aiming to shift blame for various cybercrimes worldwide onto her country.

Meanwhile, Binance is actively restoring its services after the breach, announcing on Tuesday a gradual reopening of withdrawal functions for additional cryptocurrencies and across multiple blockchain networks. This move comes as researchers continue to track the stolen funds, which have moved through thousands of wallets and several blockchains, complicating efforts to recover the assets.

Blockchain analytics firms Elliptic and Chainalysis have been at the forefront of tracing these stolen assets. Their investigations reveal that the hackers employed sophisticated and automated methods to obscure the money trail. In just the first four days following the hack, the perpetrators utilized approximately 12,000 wallets distributed over 11 blockchains and performed more than 40,000 transactions. This activity suggested a high level of automation, with new wallets created roughly every 25 seconds.

Much of the initial laundering took place on the Tron blockchain. Here, the stolen cryptocurrencies were spread across about 7,700 addresses before being transferred to Ethereum using cross-chain bridges. Elliptic reports that at least $147 million moved out of Tron via these bridges. The hackers also exploited decentralized exchanges to convert stolen stablecoins into cryptocurrencies like ether, which cannot be frozen by issuers. Around $786 million of stablecoins were swapped before issuers such as Tether and Circle intervened to freeze remaining assets.

As the laundering progressed, it expanded to other blockchain networks, including Solana. Chainalysis noted that after moving over $500 million through intermediary wallets on Tron, North Korean-linked hackers entered a new phase of laundering operations. Elliptic also detected early signs of bitcoin mixing, a process that obscures transaction trails. By early Monday, about 28 bitcoins, valued at roughly $2.2 million, had passed through 18 mixing transactions.

Despite the extensive circulation of stolen funds, approximately $2.85 billion—about 44 percent of the total $6.43 billion identified by Elliptic—has been frozen or seized by authorities. Around $3.24 billion remains in wallets tied to the theft, predominantly held in bitcoin and ether. Interestingly, very little of the stolen cryptocurrency appears to have been cashed out into fiat currency. Most of the activity involves transferring or converting cryptocurrencies within the blockchain ecosystem rather than withdrawing them for spending.

Elliptic compared the current laundering speed to a previous major hack in February 2025, when North Korean hackers moved $1.5 billion in stolen ether within just 10 days. In contrast, the Binance hack laundering is progressing more slowly. Experts anticipate that the remaining assets will gradually be converted into bitcoin and potentially cashed out over the coming months through over-the-counter brokers and exchanges.

Binance has confirmed that it has compensated roughly 95 percent of the stolen amount. The remaining five percent consists mainly of less liquid tokens, which require more time to recover. The exchange stated it is collaborating with industry partners to secure these remaining assets, aiming to fully resolve the consequences of the breach.

This incident highlights the ongoing challenges cryptocurrency platforms face in securing digital assets against sophisticated cyberattacks. It also underscores the increasing complexity of tracking illicit cryptocurrency movements across multiple blockchains. As blockchain technology evolves, so do the tactics of cybercriminals, prompting continuous efforts from exchanges, regulators, and security firms to enhance monitoring and recovery capabilities.