North Korea denies allegations that it is involved in an estimated $6.3 billion Binance State media called the accusations a “grave political provocation.”
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, condemned what the FBI said was the work of the North Korean-linked hacker group Trader Traitor, Yonap news agency reported on Tuesday, citing the state-run Korean Central News Agency.
Blockchain analysis firms such as Elliptic and Chainalysis have also linked the attack and subsequent movement of stolen funds to North Korean-related actors.
According to KCNA, Kim said, “The FBI is trying to brand North Korea as a “cybercriminal state,” claiming that it has received information that a hacking organization “supported” by North Korea was involved in the incident.”
She accused the United States of misleading international opinion by portraying cybercrime around the world as the work of North Korea.
Separately, Binance on Tuesday announced that it would gradually resume withdrawals of additional crypto assets on more networks, expanding its gradual restoration of services following last week’s hack.
The denial comes as the blockchain analytics firm traces billions of dollars in cryptocurrencies stolen from Binance through thousands of wallets across multiple blockchains.
oval and chain analysis North Korea-linked hackers said they were using increasingly complex techniques to hide their financial tracks.
Elliptic said in a report on Monday that in the first four days after the attack, the hackers used approximately 12,000 wallets across 11 blockchains to make more than 40,000 transactions. This activity was highly complex and automated, with an average of one new wallet being used every 25 seconds.
According to Elliptic, much of the laundering activity initially took place on the Tron blockchain, with the stolen funds distributed across approximately 7,700 addresses before being moved to Ethereum through a cross-chain bridge. At least $147 million was transferred from Tron through such bridges.
Hackers also used decentralized exchanges to exchange stolen stablecoins for cryptocurrencies (such as Ether) that cannot be frozen by their issuers. According to Elliptic, approximately $786 million of stablecoins were converted before issuers such as Tether and Circle froze the remaining assets.
Laundering activities have since expanded to other blockchains. Solana. Chainalysis said North Korea-linked threat actors moved more than $500 million through intermediary wallets on Tron, initiating a new phase of money laundering.
Elliptic also identified the first signs of Bitcoin commingling, a technique designed to make transactions difficult to trace. The company said that as of early Monday morning, approximately 28 Bitcoins (worth $2.2 million) had passed through 18 mixed transactions.
Despite the large-scale movement of funds, approximately $2.85 billion (44% of the $6.43 billion stolen that Elliptic reported) was frozen or seized, and approximately $3.24 billion remained in addresses associated with the theft, mostly in Bitcoin and Ether.
The company said only a small amount of the stolen funds appear to have been converted into cash, and that most of the activity involved transfers and conversions between cryptocurrencies, rather than converting them into usable funds.
Elliptic said the laundering movement was slower than since the $1.5 billion Bybit hack in February 2025, when North Korean hackers moved all of the stolen ether within 10 days. The company expects that the remaining funds will be gradually converted to Bitcoin and potentially cashed out through over-the-counter brokers and exchanges over several months.
Binance added that it covers approximately 95% of the amount affected, with the remaining 5% consisting of illiquid tokens that take time to raise. The exchange said it is working with industry partners to acquire the remaining assets.
