North Korea Denies Involvement in Binance Crypto Theft
North Korea has rejected allegations that it was behind the estimated $6.3 billion theft from cryptocurrency exchange Binance, describing the accusation as a “grave political provocation” as blockchain investigators continue to track the movement of stolen assets across multiple networks.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, condemned the FBI’s attribution of the attack to TraderTraitor, a hacking group linked to Pyongyang, according to South Korea’s Yonhap News Agency, which cited North Korea’s state-run Korean Central News Agency on Tuesday.
"The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident," Kim said, according to KCNA.
She accused Washington of misleading international public opinion by presenting cybercrimes around the world as the work of North Korea.
The denial comes as blockchain analytics firms Elliptic and Chainalysis have independently linked the attack and the subsequent movement of stolen funds to North Korean actors. Their investigations have documented an extensive laundering operation involving thousands of cryptocurrency wallets, tens of thousands of transactions, and several blockchain networks.
Binance, meanwhile, said Tuesday it would progressively reopen withdrawals for additional crypto assets across more networks, extending the phased restoration of services following last week’s attack.
Laundered Crypto Funds: A Complex Trail
The scale and complexity of the laundering operation have made tracking the stolen assets a substantial challenge for investigators.
Elliptic said in a report published Monday that hackers used approximately 12,000 wallets across 11 blockchains during the first four days after the attack. The operation involved more than 40,000 transactions, with an average of one new wallet being used every 25 seconds.
The rapid creation and movement of funds across wallets suggested a highly automated operation designed to fragment the stolen assets and complicate efforts to follow their trail. Much of the initial activity took place on the Tron blockchain, where the hackers distributed stolen funds across approximately 7,700 addresses. They subsequently moved assets to Ethereum through cross-chain bridges. Elliptic identified at least $147 million transferred out of Tron through those bridges.
The hackers also used decentralized exchanges to convert stolen stablecoins into cryptocurrencies whose transactions cannot be reversed or whose assets cannot be frozen by the issuers. Ether was among the assets used in these conversions.
Elliptic estimated that approximately $786 million in stablecoins had been converted before issuers, including Tether and Circle, froze the remaining assets.
The operation has since expanded beyond Tron and Ethereum. Chainalysis said North Korea-linked actors had begun another phase of laundering after moving more than $500 million through intermediary wallets on Tron, with activity extending to other networks, including Solana.
Elliptic also identified early signs of bitcoin mixing, a technique that combines cryptocurrency transactions to make the movement of funds harder to trace. By early Monday, approximately 28 bitcoin, worth $2.2 million, had passed through 18 mixing transactions, the firm said.
The use of multiple blockchains, cross-chain bridges, decentralized exchanges, and mixing services shows how stolen cryptocurrency can be moved through a fragmented financial system without relying on conventional banking channels. Each conversion creates additional tracing challenges, particularly when funds are split across large numbers of wallets.