North Korea denies responsibility for the record $6.3 billion Binance hack as US agencies and blockchain analysts trace stolen funds to Pyongyang

North Korea has denied responsibility for the $6.3 billion Binance hack, the largest cryptocurrency heist in history, as the FBI, the Secret Service, and blockchain analysts attribute the attack to Pyongyang. Kim Yo-jong, director of the General Affairs Department and sister of leader Kim Jong Un, dismissed the allegations on Tuesday as “absurd rhetoric” and a “sinister attempt” by the US to damage Pyongyang’s image.

“It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo-jong said in a statement. The denial came after the FBI and Secret Service said the attack was led by TraderTraitor, a state-backed hacking group also known as the Lazarus Group. The FBI called on industry partners to block transactions involving cryptocurrency accounts linked to the group. The same unit was blamed for the then-record $1.5 billion hack of crypto exchange Bybit in February 2025.

Binance said an engineer’s laptop was compromised, enabling an attacker to make unauthorised withdrawals. Trading resumed after the exchange worked with issuers to freeze impacted assets, and customers pulled out more than $3.6 billion as the platform reopened. Binance says it has covered about 95% of stolen assets and is working with industry partners to source the remaining 5%, which consists of less liquid tokens that take longer to acquire. The exchange also warned users against scammers offering to expedite transactions or help claim compensation.

Following the money

Blockchain analytics firms Elliptic and Chainalysis said North Korea-linked hackers used increasingly complex techniques to obscure the fund trail. In the first four days after the attack, hackers used roughly 12,000 wallets across 11 blockchains and conducted more than 40,000 transactions, an average of one new wallet every 25 seconds, according to Elliptic. Much of the laundering initially took place on Tron, where stolen funds were distributed across about 7,700 addresses before moving to Ethereum through cross-chain bridges. At least $147 million was transferred out of Tron through such bridges. Hackers then used decentralized exchanges to swap stablecoins into unfreezable cryptocurrencies including ether, converting roughly $786 million before Tether and Circle froze the remaining assets. Chainalysis identified a new laundering phase after more than $500 million moved through intermediary wallets on Tron, and Elliptic detected early bitcoin mixing, with about 28 bitcoin worth $2.2 million passing through 18 mixing transactions.

About $2.85 billion — 44% of the $6.43 billion stolen per Elliptic — has been frozen or seized. Roughly $3.24 billion remains in addresses linked to the theft, mostly in bitcoin and ether, and only a negligible amount appears to have been cashed out. Elliptic said laundering has moved slower than after the Bybit hack, when all stolen ether was moved within 10 days. The firm expects remaining funds to be gradually converted into bitcoin and potentially cashed out through over-the-counter brokers over several months.

Pyongyang’s cyber playbook

North Korea has been accused of relying on cyber-crime to finance its sanctioned economy. Pyongyang has systematically built its cyber operations, recruiting promising students from universities for hacker units overseen by its intelligence agency. The S Rajaratnam School of International Studies has reported on these recruitment practices, which form part of a broader strategy to generate revenue outside international sanctions. The country has consistently denied such claims.