North Korea denies links to Binance hack as researchers trace stolen billions

North Korea rejected U.S. allegations linking Pyongyang to the estimated $6.3 billion Binance hack, calling the accusation a “grave political provocation,” according to state media.

Kim Yo Jong, sister of North Korean leader Kim Jong Un, denounced the FBI's attribution of the attack to North Korea-linked hacking group TraderTraitor, Yonhap reported Tuesday, citing the state-run Korean Central News Agency.

"The FBI is trying to brand the DPRK as a 'cyber criminal state', claiming that it obtained information that a hacking organization 'supported' by the DPRK was involved in the incident," Kim said, according to KCNA.

She accused Washington of misleading international public opinion by portraying cybercrimes around the world as the work of North Korea.

The denial comes as blockchain analytics firms trace billions of dollars in cryptocurrency stolen from Binance through thousands of wallets across multiple blockchains.

Elliptic and Chainalysis said hackers linked to North Korea have used increasingly complex techniques to obscure the trail of the funds.

In the first four days after the attack, the hackers used roughly 12,000 wallets across 11 blockchains and conducted more than 40,000 transactions, Elliptic said in a report Monday. The activity appeared highly complex and automated, with an average of one new wallet used every 25 seconds.

Much of the laundering activity initially took place on the Tron blockchain, where stolen funds were distributed across about 7,700 addresses before being moved to Ethereum through cross-chain bridges, according to Elliptic. At least $147 million had been transferred out of Tron through such bridges.

The hackers also used decentralized exchanges to swap stolen stablecoins into cryptocurrencies that cannot be frozen by their issuers, including ether. Elliptic said roughly $786 million in stablecoins was converted before issuers including Tether and Circle froze the remaining assets.

The laundering operation has since expanded to other blockchains, including Solana. Chainalysis said North Korea-linked actors had begun a new phase of laundering after moving more than $500 million through intermediary wallets on Tron.

Elliptic also identified the first signs of bitcoin mixing, a technique designed to make transactions harder to trace. About 28 bitcoin, worth $2.2 million, had passed through 18 mixing transactions as of early Monday, the firm said.

Despite the extensive movement of funds, about $2.85 billion — or 44% of exactly $6.43 billion stolen as reported by Elliptic — has been frozen or seized, while roughly $3.24 billion remains in addresses linked to the theft, mostly in bitcoin and ether.

The firm said only a negligible amount of stolen funds appeared to have been cashed out, with most of the activity involving transfers or conversions between cryptocurrencies rather than exchanges into spendable funds.

Elliptic said the laundering has moved slower than after the $1.5 billion Bybit hack in February 2025, when North Korean hackers moved all the stolen ether within 10 days. It expects the remaining funds to be gradually converted into bitcoin and potentially cashed out through over-the-counter brokers and exchanges over several months.

Binance, meanwhile, said withdrawals were resuming in phases and warned users against scammers offering to expedite transactions or help claim compensation.