North Korea Rejects Binance Hack Blame as Analysts Track Billions Through Thousands of Wallets

North Korea has rejected US allegations that it was behind the estimated $6.3 billion Binance hack, calling the claim a "grave political provocation", according to state media. Kim Yo Jong, sister of leader Kim Jong Un, criticised the FBI's attribution of the attack to TraderTraitor, a hacking group linked to North Korea. She accused Washington of misleading international opinion by portraying cybercrime around the world as the work of her country.

Meanwhile, blockchain analytics firms Elliptic and Chainalysis are tracing the stolen funds. Elliptic reported that in the first four days, the hackers used roughly 12,000 wallets across 11 blockchains and made more than 40,000 transactions, with a new wallet used on average every 25 seconds. The activity appeared highly complex and automated. Funds were first spread across about 7,700 addresses on the Tron blockchain, then moved to Ethereum through cross-chain bridges, with at least $147 million transferred this way.

The hackers also swapped about $786 million in stablecoins into assets that issuers cannot freeze, such as ether, before Tether and Circle froze the remaining assets. Laundering has since spread to other blockchains, including Solana, and Chainalysis said a new phase began after more than $500 million moved through intermediary wallets on Tron. Elliptic also saw early signs of bitcoin mixing, with about 28 bitcoin (worth $2.2 million) passing through 18 mixing transactions.