Twelve thousand wallets, forty thousand transactions, four days: that is the scale of the laundering effort that blockchain analysts say followed the theft of roughly $6.3 billion from Binance. On Tuesday the government they blame for it called the whole thing a fabrication.
The denial came from Kim Yo Jong, the sister of leader Kim Jong Un, who described the accusation as a "grave political provocation," according to state media relayed by Yonhap. Her statement, as CNBC reported, took aim at the FBI's attribution of the attack to TraderTraitor, a hacking unit also known as the Lazarus Group. In her telling, Washington is eager to paint North Korea as a criminal state in cyberspace, and pins on Pyongyang virtually every theft that occurs online. The script is familiar. North Korea rejected the same charge after the $1.5 billion Bybit theft in 2025.
What the wallets show
The analytics firms point to the blockchain itself. In a report published Monday, Elliptic said the thieves opened a fresh wallet roughly every 25 seconds, a tempo that suggests automation rather than a team of people clicking through screens. Much of the early activity ran through the Tron blockchain, where funds were spread over roughly 7,700 addresses before heading to Ethereum across cross-chain bridges. At least $147 million left Tron that way.
Stablecoins were a problem for the thieves, because issuers can freeze them. So they swapped them on decentralized exchanges for assets such as ether that no company can lock. Elliptic put the converted amount at about $786 million before Tether and Circle froze what remained. Chainalysis later argued that the laundering had moved into a different stage, with more than half a billion dollars passing through intermediary wallets on Tron and Solana now added to the route. Elliptic also spotted the first bitcoin mixing. The amount was small, 28 bitcoin, about $2.2 million, over 18 transactions.
The recovery picture is mixed. Elliptic counts about $2.85 billion, or 44% of the $6.43 billion it tallies as stolen, as either frozen or seized. Around $3.24 billion still sits in addresses tied to the theft, mostly bitcoin and ether, and only a negligible sum appears to have reached cash. The pace is slower than at Bybit, where the stolen ether was moved on within 10 days. Elliptic expects the remainder to be funneled toward bitcoin and possibly sold through over-the-counter brokers over several months. Holding that much for that long is a risk of its own. Freezes tend to happen in the gaps.
Attribution without a confession
Nobody outside the investigation has seen everything the FBI has, which is the usual predicament with attribution. What the public record offers is a pattern. TRM Labs said the attack shared several hallmarks with earlier incidents linked to North Korea, and, as the BBC reported, Chainalysis expressed high confidence that Pyongyang was behind it. Researchers have long described a state apparatus that recruits promising university students into hacking units run by the intelligence service. Pyongyang, hemmed in by sanctions and short of legitimate industry, is widely believed to use theft as a revenue line.
Binance has said less about who and more about how. It first pointed to a compromised engineer's laptop, then conceded the breach was wider, with co-CEO Richard Teng describing a mechanism that erased the intruders' tooling as they went. On compensation, the exchange says roughly 95% of the affected amount has now been made good. The remainder is in less liquid tokens, which take longer to buy. According to the BBC, customers have pulled a net $5.27 billion since withdrawals restarted on Sunday, though Binance says activity has stabilised. On Tuesday it began reopening withdrawals for additional assets across a wider set of networks.
The outflow figure is the one to watch. Promises to make customers whole sound familiar to anyone who remembers FTX, and lawyers have cautioned that such pledges may not be binding in court. The verdict on the Binance hack will owe less to the denial from Pyongyang than to whether the remaining $3.24 billion is frozen before it is cashed out, and whether depositors keep believing the exchange can pay.