North Korea denies being behind record $6.3bn Binance hack

North Korea has denied U.S. allegations that it was linked to the $6.3 billion hack of the Binance crypto exchange. According to CNBC, North Korea's state media called the accusation a political provocation.

Kim Yo Jong denounced the FBI's attribution of the attack to the North Korea-linked hacking group TraderTraitor. She said: "The FBI is trying to brand the DPRK as a 'cyber criminal state', claiming that it obtained information that a hacking organization 'supported' by the DPRK was involved in the incident." She also accused Washington of misleading international opinion by portraying cybercrimes worldwide as the work of North Korea.

Blockchain analytics firm Elliptic published a report on Monday tracing the stolen funds. It said that in the first four days after the attack the hackers used roughly 12,000 wallets across 11 blockchains and carried out more than 40,000 transactions. On average a new wallet was used every 25 seconds, and the activity appeared highly complex and automated.

Much of the laundering first took place on the Tron blockchain, with funds spread across about 7,700 addresses before moving to Ethereum through cross-chain bridges. Elliptic said at least $147 million had been moved out of Tron this way. It also said roughly $786 million in stablecoins was converted before issuers including Tether and Circle froze the remaining assets.

Chainalysis said North Korea-linked actors began moving stolen funds onto Solana after draining $500 million from Tron staging wallets. Elliptic also identified the first signs of bitcoin mixing, with about 28 bitcoin worth $2.2 million passing through 18 mixing transactions as of early Monday.

Elliptic put the stolen amount at $6.43 billion, of which about 44% has been frozen or seized, or about $2.85 billion. About $3.24 billion remains in addresses linked to the theft, mostly in bitcoin and ether. Only a negligible amount appeared to have been cashed out.

Elliptic said the laundering has moved slower than after the $1.5 billion Bybit hack in February 2025, when North Korean hackers moved all stolen ether within 10 days. It expects the remaining funds to be gradually converted into bitcoin and possibly cashed out through over-the-counter brokers and exchanges over several months.

Binance said withdrawals are resuming in phases and warned users against scammers offering to speed up transactions or help claim compensation. It said it has covered about 95% of the affected amount, and the remaining 5% is made up of less liquid tokens that take longer to source. It is working with industry partners to acquire them.