From Decrypt · By Decrypt Agent
In brief
North Korea has denied it was behind the hack of Binance, with Kim Yo Jong calling U.S. accusations a "sinister" attempt to damage the country's image.
The FBI, the Secret Service and blockchain analytics firms have attributed the theft to TraderTraitor, the North Korean group blamed for the Bybit hack.
Binance said net withdrawals since Sunday reached $4.72 billion, but that hourly deposits began exceeding withdrawals late on Monday.
North Korea has rejected U.S. findings that it was behind the record hack of Binance, calling the FBI's attribution a "grave political provocation," Yonhap reported on Tuesday.
"It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds," Kim Yo Jong, the sister of leader Kim Jong Un, said in a statement carried by the state-run Korean Central News Agency. She called the accusation a "sinister" attempt to damage North Korea's international image.
Kim also turned the blame back on Washington, pointing to the Trump administration's plan to use confiscated crypto as a strategic reserve. Anyone who looks at who will end up with "the so-called stolen cryptocurrency" once it is retrieved "may get a clue about who is behind the hacking incident," she said.
The FBI said on Saturday that North Korean hackers it calls TraderTraitor were responsible for the theft of more than $6 billion from Binance, confirming the attribution blockchain analytics firms TRM Labs and Chainalysis made last week. The FBI attributed the $1.5 billion hack of crypto exchange Bybit in February 2025 to the same group. North Korea has denied previous accusations of hacking.
PredictEconomyWhich companies will IPO before 2027?
Anthropic95%YesNoCelonis9%YesNoDiscord7%YesNoFreddie Mac7%YesNoRippling5%YesNo+24 more outcomes+23 more outcomes$623.25K volumeCloses: Jan 1, 2027, 04:59 UTCCloses: Jan 1, 2027, 04:59 UTCThe hackers are moving their haul quickly. North Korea is laundering the funds at a rate of roughly one new wallet every 25 seconds, across about 12,000 wallets, Decrypt reported on Monday. About $2.85 billion of the $6.43 billion stolen has been frozen or seized, compared with roughly 3% of the funds taken from Bybit.
Not all of the stolen funds are moving at the same pace. As of Monday, more than $1 billion in ETH and about $1.42 billion in BTC had seen limited onward movement, while other funds were moving rapidly across chains, blockchain analytics firm Chainalysis said. The activity so far is broadly consistent with the "immediate layering" phase seen after past North Korean hacks, though funds repeatedly returning to earlier addresses across thousands of transactions suggests automation, the firm said. It expects the scale of the theft to "strain the actors' trusted laundering channels," pushing funds toward bridges, instant exchanges and swapping services.