North Korea has strongly denied any involvement in the recent $6.3 billion hack of Binance, calling U.S. allegations a “grave political provocation.” Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the FBI’s claim that the attack was linked to the hacking group TraderTraitor, stating that the accusations were part of a broader effort to portray North Korea as a “cyber criminal state.” The denial was reported by state media, citing the Korean Central News Agency.
Despite the denial, blockchain analytics firms Elliptic and Chainalysis have traced the stolen funds through thousands of wallets across multiple blockchains. The hackers used complex techniques to obscure the trail, including the creation of roughly 12,000 wallets across 11 blockchains and conducting over 40,000 transactions in the first four days after the attack. Much of the laundering initially took place on the Tron blockchain, where stolen funds were distributed across about 7,700 addresses before being moved to Ethereum through cross-chain bridges.
Elliptic reported that hackers converted roughly $786 million in stablecoins before issuers like Tether and Circle froze the remaining assets. The laundering operation has since expanded to other blockchains, including Solana. Chainalysis noted that North Korea-linked actors had begun a new phase of laundering after moving more than $500 million through intermediary wallets on Tron. Elliptic also identified the first signs of bitcoin mixing, a technique designed to make transactions harder to trace.
As of now, about $2.85 billion, or 44% of the stolen amount, has been frozen or seized, while roughly $3.24 billion remains in addresses linked to the theft, mostly in bitcoin and ether. Binance has resumed withdrawals in phases and warned users against scammers offering to expedite transactions or help claim compensation. The exchange has covered about 95% of the affected amount, with the remaining 5% consisting of less liquid tokens that take longer to source.