Korea denies links to the Binance hack as blockchain analytics firms trace billions of dollars moving across thousands of wallets and multiple networks. North Korea called the U.S. attribution a “grave political provocation,” while Elliptic and Chainalysis described a complex laundering operation that continues to shift across blockchains. Researchers trace stolen Binance funds, and their findings center on the scale and sequence of those movements.

Elliptic said hackers used roughly 12,000 wallets across 11 blockchains in the first four days after the attack. The firm counted more than 40,000 transactions, with an average of one new wallet used every 25 seconds. It described the activity as highly complex and automated.

Korea Denies Links as Funds Cross Blockchains

Much of the initial laundering took place on Tron, according to Elliptic. Funds spread across about 7,700 addresses before moving to Ethereum through cross-chain bridges. At least $147 million had left Tron through those bridges, the firm said.

Hackers also swapped stolen stablecoins through decentralized exchanges into cryptocurrencies that issuers cannot freeze, including ether. Elliptic said roughly $786 million in stablecoins was converted before Tether and Circle froze the remaining assets. The movements later expanded to other networks, including Solana.

Chainalysis said North Korea-linked actors had begun a new laundering phase after moving more than $500 million through intermediary wallets on Tron. Elliptic separately identified the first signs of bitcoin mixing, which is designed to make transactions harder to trace.

Analytics Firms Track Conversions and Frozen Funds

By early Monday, about 28 bitcoin, worth $2.2 million, had passed through 18 mixing transactions, Elliptic said. The firm reported that about $2.85 billion, or 44% of exactly $6.43 billion stolen as reported by Elliptic, had been frozen or seized. Roughly $3.24 billion remained in addresses linked to the theft, mostly in bitcoin and ether.

Elliptic said only a negligible amount appeared to have been cashed out. Most activity involved transfers or conversions between cryptocurrencies rather than exchanges into spendable funds.

Elliptic said this laundering moved more slowly than after the $1.5 billion Bybit hack in February 2025, when North Korean hackers moved all the stolen ether within 10 days. It expects remaining funds to be gradually converted into bitcoin and potentially cashed out through over-the-counter brokers and exchanges over several months.

Binance said it would progressively reopen withdrawals for additional crypto assets across more networks after last week’s hack. The exchange also said it had covered about 95% of the affected amount; the remaining 5% consisted of less liquid tokens that take longer to source. Binance said it was working with industry partners to acquire those assets.

Earlier BlockTelegraph coverage documented Binance outflows after the hack and the wallet permissions reported in another incident. A separate report tracks stolen funds moving into Zcash. Those articles cover distinct reporting and do not establish additional facts about the transfers described here.

The next stated development is Binance’s phased restoration of withdrawals as it works with industry partners to source the remaining less liquid tokens. The analytics firms’ accounts meanwhile describe funds still moving through linked addresses, conversions and mixing transactions.