North Korea denied FBI allegations linking Pyongyang to a $6.3 billion Binance hack, with Kim Yo Jong, sister of leader Kim Jong Un, calling the accusation a "grave political provocation" and accusing Washington of misleading international opinion.

Blockchain analytics firms Elliptic and Chainalysis traced the stolen funds through thousands of wallets across multiple blockchains, finding that hackers linked to North Korea deployed increasingly complex laundering techniques. In the first four days after the attack, hackers used roughly 12,000 wallets across 11 blockchains and conducted more than 40,000 transactions, with an average of one new wallet deployed every 25 seconds, Elliptic reported.

Much of the initial laundering occurred on the Tron blockchain, where about 7,700 addresses received stolen funds before assets moved to Ethereum through cross-chain bridges. At least $147 million transferred out of Tron via these bridges. Hackers also used decentralized exchanges to convert roughly $786 million in stablecoins into cryptocurrencies that cannot be frozen, including ether, before issuers Tether and Circle froze the remaining assets.

The operation has expanded to other blockchains including Solana, with Chainalysis reporting that North Korea-linked actors moved more than $500 million through intermediary wallets on Tron. Elliptic identified early signs of bitcoin mixing, with about 28 bitcoin worth $2.2 million passing through 18 mixing transactions.

Of the $6.43 billion stolen, Elliptic reported that $2.85 billion (44%) has been frozen or seized, while roughly $3.24 billion remains in addresses linked to the theft, mostly in bitcoin and ether. Only negligible amounts of stolen funds appeared cashed out. Elliptic noted the laundering pace is slower than after the $1.5 billion Bybit hack in February 2025, when North Korean hackers moved all stolen ether within 10 days.

Binance said Tuesday it would progressively reopen withdrawals for additional crypto assets and stated it covered about 95% of the affected amount, with the remaining 5% consisting of less liquid tokens.