North Korea has rejected allegations that it was behind the estimated $6.3 billion theft from cryptocurrency exchange Binance, describing the accusation as a “grave political provocation” as blockchain investigators continue to track the movement of stolen assets across multiple networks.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, condemned the FBI’s attribution of the attack to TraderTraitor, a hacking group linked to Pyongyang, according to South Korea’s Yonhap News Agency, which cited North Korea’s state-run Korean Central News Agency on Tuesday.
“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” Kim said, according to KCNA.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
She accused Washington of misleading international public opinion by presenting cybercrimes around the world as the work of North Korea.
The denial comes as blockchain analytics firms Elliptic and Chainalysis have independently linked the attack and the subsequent movement of stolen funds to North Korean actors. Their investigations have documented an extensive laundering operation involving thousands of cryptocurrency wallets, tens of thousands of transactions and several blockchain networks.
Binance, meanwhile, said Tuesday it would progressively reopen withdrawals for additional crypto assets across more networks, extending the phased restoration of services following last week’s attack.
The scale and complexity of the laundering operation have made tracking the stolen assets a substantial challenge for investigators.
Elliptic said in a report published Monday that hackers used approximately 12,000 wallets across 11 blockchains during the first four days after the attack. The operation involved more than 40,000 transactions, with an average of one new wallet being used every 25 seconds.
The rapid creation and movement of funds across wallets suggested a highly automated operation designed to fragment the stolen assets and complicate efforts to follow their trail.
Much of the initial activity took place on the Tron blockchain, where the hackers distributed stolen funds across approximately 7,700 addresses. They subsequently moved assets to Ethereum through cross-chain bridges. Elliptic identified at least $147 million transferred out of Tron through those bridges.
The hackers also used decentralized exchanges to convert stolen stablecoins into cryptocurrencies whose transactions cannot be reversed or whose assets cannot be frozen by the issuers. Ether was among the assets used in these conversions.
Elliptic estimated that approximately $786 million in stablecoins had been converted before issuers, including Tether and Circle, froze the remaining assets.
The operation has since expanded beyond Tron and Ethereum. Chainalysis said North Korea-linked actors had begun another phase of laundering after moving more than $500 million through intermediary wallets on Tron, with activity extending to other networks, including Solana.
Elliptic also identified early signs of bitcoin mixing, a technique that combines cryptocurrency transactions to make the movement of funds harder to trace. By early Monday, approximately 28 bitcoin, worth $2.2 million, had passed through 18 mixing transactions, the firm said.
The use of multiple blockchains, cross-chain bridges, decentralized exchanges and mixing services shows how stolen cryptocurrency can be moved through a fragmented financial system without relying on conventional banking channels. Each conversion creates additional tracing challenges, particularly when funds are split across large numbers of wallets.
Despite the extensive movement of funds, a substantial portion of the stolen cryptocurrency has not been converted into cash or moved beyond investigators’ ability to track it.
Elliptic said approximately $2.85 billion, representing 44% of the $6.43 billion stolen in the attack according to its estimate, had been frozen or seized. Roughly $3.24 billion remained in addresses associated with the theft, primarily in bitcoin and ether.
The figures indicate that much of the laundering activity has involved transferring or converting assets between cryptocurrencies rather than successfully cashing them out through exchanges or other channels.
Moving stolen funds across wallets does not necessarily mean the hackers have gained access to equivalent amounts of spendable money. Stablecoin issuers can freeze tokens held at identifiable addresses, while exchanges and other service providers can restrict transactions involving flagged assets.
Elliptic said the laundering process had proceeded more slowly than after the $1.5 billion Bybit hack in February 2025, when North Korean hackers moved all the stolen ether within 10 days.
The firm expects the remaining Binance-related funds to be gradually converted into bitcoin, with potential cash-outs through over-the-counter brokers and cryptocurrency exchanges over several months. Such transactions could make it harder to identify the ultimate recipients, although the movement of funds may continue to generate traceable blockchain records.
The scale of the operation also underpins the role of cooperation between cryptocurrency exchanges, blockchain analytics companies and token issuers in limiting the use of stolen assets. Freezing stablecoins can prevent some funds from being spent, but cryptocurrencies such as bitcoin and ether do not have a central issuer with equivalent control over individual wallets.
Binance said it had covered approximately 95% of the affected amount, while the remaining 5% consisted of less liquid tokens that were taking longer to source. The exchange said it was working with industry partners to acquire the outstanding assets.
The recovery effort and gradual reopening of withdrawals are intended to restore normal operations, but the investigation remains focused on tracing the remaining funds and determining how much can ultimately be recovered.
However, North Korea’s denial adds a diplomatic dispute to an incident that has already raised questions about the security of major cryptocurrency platforms and the ability of state-linked hacking groups to move large amounts of digital assets across global networks.