North Korea has denied involvement in the Binance theft, calling US claims that a North Korea-linked hacking group was responsible a “serious political provocation.” Meanwhile, blockchain analytics firm Elliptic estimates that about $2.85 billion of the $6.43 billion in stolen assets has been frozen or recovered, while roughly $3.24 billion remains in addresses linked to the attack. The funds have moved across multiple blockchains and thousands of wallets, complicating efforts to trace and recover them.
Kim Yo Jong rejects the US attribution
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, criticized the FBI for attributing the attack to TraderTraitor, a hacking group linked to North Korea. North Korean state media quoted her as saying the FBI was trying to portray the country as a “cybercrime state” and accused Washington of misleading international opinion.
Pyongyang denies responsibility, while the US maintains its attribution. Beyond the dispute over who was behind the attack, the funds’ movements and the amount that can be recovered remain central concerns for Binance users and the wider crypto market.
About 12,000 wallets used in four days
In an analysis published Monday, Elliptic said those moving the funds used about 12,000 wallets across 11 blockchains during the first four days after the attack. They carried out more than 40,000 transactions, activating an average of one new wallet every 25 seconds. Elliptic described the pattern as a highly sophisticated and automated transfer operation.
Much of the money initially moved through the Tron network before being split across about 7,700 addresses and routed to Ethereum via cross-chain bridges. At least $147 million left Tron through these bridges, Elliptic said. Moving assets between chains broadens the scope of the investigation, requiring addresses and transactions on different networks to be tracked together.
Stablecoin freezes and cross-chain conversions
The attackers used decentralized exchanges to convert stolen stablecoins into assets that issuers could not freeze, including ether. Elliptic estimates that about $786 million in stablecoins had been converted before issuers such as Tether and Circle froze the remaining assets.
Chainalysis said North Korea-linked actors began a new phase of laundering after moving more than $500 million through intermediary wallets on Tron. The funds have also spread to other blockchains, including Solana. Elliptic has detected early signs of Bitcoin mixing: by early Monday, about 28 BTC, worth roughly $2.2 million, had passed through 18 mixing transactions. Mixing can make transaction tracing more difficult, but information disclosed so far does not indicate that these assets have been converted into fiat currency.
44% of the stolen funds frozen or recovered
Based on Elliptic’s estimate of $6.43 billion stolen, about $2.85 billion, or 44%, has been frozen or recovered. Roughly $3.24 billion remains in addresses linked to the attack, primarily in Bitcoin and ether. Elliptic said only a very small portion appears to have been cashed out so far; most of the activity involves transfers or conversions between crypto assets.
Elliptic said the funds are moving more slowly than after the $1.5 billion Bybit attack in February 2025, when North Korean hackers transferred all of the stolen ether within 10 days. The firm expects the remaining Binance funds could gradually be converted into Bitcoin over several months, potentially with cash-outs through over-the-counter brokers or exchanges. That is an assessment of possible future routes, not a description of flows that have already occurred.
Binance resumes withdrawals in stages
Binance said withdrawals are being restored in stages and warned users about scammers claiming they can speed up transactions or help secure compensation. The exchange also said it has covered about 95% of the affected amount. The remaining 5% consists of tokens with lower liquidity that will take longer to source, and Binance is working with industry partners to obtain them.
For users, the pace of withdrawal restoration and the sourcing of the remaining assets are immediate concerns. For tracking firms, cross-chain transfers and conversions continue to complicate recovery efforts. Binance’s coverage figure reflects the platform’s response, while analytics firms’ estimates describe the on-chain status of stolen funds; the figures measure different things and should not be treated as equivalent.