PYONGYANG/SEOUL -- North Korea on Monday denied U.S. allegations linking Pyongyang to the estimated $6.4 billion Binance hack, calling the accusation a "grave political provocation" and an attempt to brand the country as a "cyber criminal state."
Kim Yo Jong, the powerful sister of leader Kim Jong Un, said the FBI's claim that a hacking organization "supported" by the DPRK was involved in the incident was "absurd rhetoric and nothing new," according to the Korean Central News Agency.
The denial comes as blockchain analytics firms Elliptic and Chainalysis have traced billions of dollars in cryptocurrency stolen from Binance through thousands of wallets across multiple blockchains. In the first four days after the attack, hackers used roughly 12,000 wallets across 11 blockchains and conducted more than 40,000 transactions, Elliptic said. The activity appeared highly complex and automated, with an average of one new wallet used every 25 seconds.
Much of the laundering activity initially took place on the Tron blockchain, where stolen funds were distributed across about 7,700 addresses before being moved to Ethereum through cross-chain bridges, according to Elliptic. At least $147 million had been transferred out of Tron through such bridges. Hackers also used decentralized exchanges to swap stolen stablecoins into cryptocurrencies that cannot be frozen by their issuers, including ether. Elliptic said roughly $786 million in stablecoins was converted before issuers including Tether and Circle froze the remaining assets.
The laundering operation has since expanded to other blockchains, including Solana. Chainalysis said North Korea-linked actors had begun a new phase of laundering after moving more than $500 million through intermediary wallets on Tron. Elliptic also identified the first signs of bitcoin mixing, a technique designed to make transactions harder to trace. About 28 bitcoin, worth $2.2 million, had passed through 18 mixing transactions as of early Monday.
About $2.85 billion, or 44% of exactly $6.43 billion stolen as reported by Elliptic, has been frozen or seized, while roughly $3.24 billion remains in addresses linked to the theft, mostly in bitcoin and ether. Elliptic said only a negligible amount of stolen funds appeared to have been cashed out, with most of the activity involving transfers or conversions between cryptocurrencies rather than exchanges into spendable funds. The firm said the laundering has moved slower than after the $1.5 billion Bybit hack in February 2025, when North Korean hackers moved all the stolen ether within 10 days. It expects the remaining funds to be gradually converted into bitcoin and potentially cashed out through over-the-counter brokers and exchanges over several months.
Binance, meanwhile, said withdrawals were resuming in phases and warned users against scammers offering to expedite transactions or help claim compensation. The exchange added it has covered about 95% of the affected amount, with the remaining 5% consisting of less liquid tokens that take longer to source. Binance said it was working with industry partners to acquire the remaining assets.
The hack has prompted South Korea to call for increased protections for its digital infrastructure against cyberattacks. President Lee Jae Myung said existing security systems centred on inspections and responses after incidents have revealed clear limitations as hacking techniques become increasingly intelligent, sophisticated and commonplace with the development of artificial intelligence.
North Korea also test-fired strategic cruise missiles fitted with new cluster-munition warheads, demonstrating weapons capabilities amid the international attention on the hack. The test demonstrated the capability to deliver a vertical strike against targets by improving the terminal maneuverability of the cruise missile, the Korean Central News Agency said.
A North Korean official was quoted as saying the test was conducted "because our armed forces should defend the security of the country and deter all sorts of threats." The launch aims to provide "double deterrence against South Korea by strengthening conventional asymmetric strike capabilities at a stage before the use of nuclear weapons," a professor told AFP.
The incident underscores the evolving sophistication of cryptocurrency laundering techniques and the ongoing challenge for regulators to trace and freeze illicit digital assets, even as North Korea continues to deny involvement.
