Key Highlights

  • North Korea called the FBI's attribution of the Binance hack to TraderTraitor a "grave political provocation," according to state media.
  • Elliptic says the hackers used about 12,000 wallets across 11 blockchains and over 40,000 transactions in four days.
  • About USD 2.85 billion, or 44% of the USD 6.43 billion stolen, has been frozen or seized.
  • Binance says it has covered about 95% of the affected amount and is reopening more withdrawals in phases.

North Korea Rejects the Attribution

North Korea has denied involvement in the hack of crypto exchange Binance, calling the accusation a "grave political provocation," according to state media on Tuesday, November 3, 2026. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, criticized the FBI's attribution of the attack to TraderTraitor, a hacking group linked to North Korea.

"The FBI is trying to Brand the DPRK as a 'cyber criminal state', claiming that it obtained information that a hacking organization 'supported' by the DPRK was involved in the incident," Kim said, according to the state news agency. She accused Washington of misleading international public opinion by presenting cybercrimes around the world as the work of North Korea.

Blockchain analytics firms Elliptic and Chainalysis have also linked the attack, and the later movement of the stolen funds, to North Korea linked actors.

The Scale of the Theft

Binance's initial estimate put the loss at about USD 6.3 billion. Elliptic reports the amount stolen as exactly USD 6.43 billion. The attack occurred last week, and Binance has since restored services in phases.

How the Funds Moved

In the first four days after the attack, the hackers used roughly 12,000 wallets across 11 blockchains and conducted more than 40,000 transactions, Elliptic said in a report on Monday. The activity appeared highly complex and automated, with an average of one new wallet used every 25 seconds.

Much of the early laundering took place on the Tron blockchain, where the stolen funds were spread across about 7,700 addresses before moving to Ethereum through cross chain bridges. At least USD 147 million had left Tron through such bridges.

The hackers also used decentralized exchanges to swap stolen stablecoins into cryptocurrencies that issuers cannot freeze, including ether. Elliptic said roughly USD 786 million in stablecoins was converted before issuers including Tether and Circle (NYSE:CRCL) froze the remaining assets.

Laundering Spreads and Mixing Begins

The operation has since reached other blockchains, including Solana. Chainalysis said North Korea linked actors began a new phase of laundering after moving more than USD 500 million through intermediary wallets on Tron.

Elliptic also identified the first signs of Bitcoin mixing, a technique that makes transactions harder to trace. About 28 bitcoin, worth USD 2.2 million, had passed through 18 mixing transactions as of early Monday, the firm said.

What Has Been Frozen and What Remains

About USD 2.85 billion, or 44% of the USD 6.43 billion stolen, has been frozen or seized. Roughly USD 3.24 billion remains in addresses linked to the theft, mostly in bitcoin and ether. Elliptic said only a negligible amount appeared to have been cashed out, as most activity involved transfers or conversions between cryptocurrencies, not exchanges into spendable funds.

A Slower Pace Than Bybit

Elliptic said the laundering has moved more slowly than after the USD 1.5 billion Bybit hack in February 2025, when North Korean hackers moved all of the stolen ether within 10 days. It expects the remaining funds to be converted gradually into bitcoin and potentially cashed out through over the counter Brokers and exchanges over several months.

Binance Restores Services

Binance said on Tuesday that it will progressively reopen withdrawals for additional crypto Assets across more networks, expanding the phased restoration that began after the attack. The exchange added that it has covered about 95% of the affected amount. The remaining 5% consists of less liquid tokens that take longer to source, and Binance said it is working with industry partners to acquire them.

What to Watch Next

Items on the calendar include further Binance Withdrawal reopenings, additional freezes or seizures of the stolen funds, the movement of the roughly USD 3.24 billion still in linked addresses, further bitcoin mixing activity, and any further statements from the FBI or North Korean state media.