North Korea Denies Binance Hack Involvement Amid Massive Asset Tracing
State officials reject FBI accusations as investigators track billions in stolen cryptocurrency.
1Official Denial of Allegations
North Korea officially rejected claims linking Pyongyang to the $6.3 billion Binance hack, labeling the accusations a grave political provocation. Kim Yo Jong, sister of leader Kim Jong Un, specifically denounced the FBI for attempting to brand the state as a cyber criminal entity through the involvement of the hacking group TraderTraitor.
2Sophisticated Laundering Operations
Blockchain analytics firms Elliptic and Chainalysis report that hackers utilized highly complex, automated techniques to obscure fund movements. Within four days, attackers employed approximately 12,000 wallets across 11 different blockchains. This automated process involved executing over 40,000 transactions, with the system generating a new wallet address every 25 seconds on average.
3Cross-Chain Asset Movement
The laundering activity primarily utilized the Tron blockchain, where funds were distributed across 7,700 addresses before moving to Ethereum via cross-chain bridges. At least $147 million was transferred through these bridges. Hackers also swapped stablecoins into ether to avoid issuer-level freezes, though Tether and Circle successfully froze approximately $786 million in assets.
4Current Status of Stolen Funds
Elliptic reports that $2.85 billion, representing 44% of the $6.43 billion total, has been frozen or seized. Approximately $3.24 billion remains in addresses linked to the theft, primarily held in bitcoin and ether. Only a negligible amount has been cashed out, as most activity involves internal conversions rather than external liquidations.
5Emerging Obfuscation Techniques
Investigators have identified the first signs of bitcoin mixing, a technique specifically designed to make transaction trails harder to follow. As of Monday, 28 bitcoin worth $2.2 million had already passed through 18 mixing transactions. This shift indicates that actors are diversifying their methods beyond simple cross-chain transfers to further complicate asset tracking.
6Comparative Laundering Velocity
The current laundering process is moving significantly slower than the $1.5 billion Bybit hack observed in February 2025. During that incident, hackers moved all stolen ether within 10 days. Analysts expect the remaining Binance funds to be gradually converted into bitcoin and liquidated through over-the-counter brokers over the coming months.
7Binance Service Restoration
Binance has begun a phased restoration of services, progressively reopening withdrawals for additional crypto assets across multiple networks. The exchange confirmed it has covered approximately 95% of the affected amount. The remaining 5% consists of less liquid tokens, and the company is collaborating with industry partners to source these specific assets.
8Geopolitical and Financial Implications
The incident highlights the ongoing tension between state-sponsored cyber activities and global financial infrastructure security. While North Korea denies involvement, the scale of the theft and the complexity of the laundering operations underscore the persistent threat to decentralized exchanges. Future security depends on cross-chain monitoring and rapid collaboration between exchanges and firms.