North Korea has denied links to the Binance hack as blockchain analytics firms trace billions of dollars in stolen funds moving across thousands of wallets and multiple networks. Pyongyang called the U.S. attribution a “grave political provocation,” while Elliptic and Chainalysis described a complex laundering operation that continues to shift from one blockchain to another. Researchers are tracing the stolen Binance funds, and their findings center on the scale and sequence of those movements.

Laundering Spans 11 Blockchains and 12,000 Wallets

Elliptic said hackers used roughly 12,000 wallets across 11 blockchains in the first four days after the attack. The firm counted more than 40,000 transactions, with an average of one new wallet coming into use every 25 seconds, and described the activity as highly complex and automated.

Much of the initial laundering took place on Tron, according to Elliptic. The network is widely used for stablecoin transfers. Funds were spread across about 7,700 addresses before moving to Ethereum through cross-chain bridges — services that move assets between otherwise separate networks — and at least $147 million had left Tron by that route, the firm said.

Hackers also swapped stolen stablecoins through decentralized exchanges — platforms that let users trade tokens without a central intermediary — into cryptocurrencies that issuers cannot freeze, including ether. Tether and Circle, the issuers of the USDT and USDC stablecoins, can freeze tokens at the issuer level, a control ether does not have. Elliptic said roughly $786 million in stablecoins had been converted before Tether and Circle froze the remaining assets. The movements later expanded to other networks, including Solana.

Chainalysis reported that North Korea-linked actors had begun a new laundering phase after moving more than $500 million through intermediary wallets on Tron. Separately, Elliptic identified the first signs of bitcoin mixing, a technique designed to make transactions harder to trace.

Frozen Funds, Conversions, and a Slower Pace Than Bybit

By early Monday, about 28 bitcoin, worth $2.2 million, had passed through 18 mixing transactions, Elliptic said. The firm reported that about $2.85 billion — 44% of the $6.43 billion it says was stolen — had been frozen or seized, while roughly $3.24 billion remained in addresses linked to the theft, mostly in bitcoin and ether.

Only a negligible amount appeared to have been cashed out. Most of the activity involved transfers or conversions between cryptocurrencies rather than exchanges into spendable funds.

Elliptic noted that this laundering has moved more slowly than in the aftermath of the $1.5 billion Bybit hack in February 2025 — the largest crypto theft on record at the time — when North Korean hackers moved all of the stolen ether within 10 days. The firm expects the remaining funds to be gradually converted into bitcoin and potentially cashed out through over-the-counter brokers — desks that settle large trades away from public order books — and exchanges over several months.

Binance Restores Withdrawals

Binance said it would progressively reopen withdrawals for additional crypto assets across more networks following last week’s hack. The exchange also said it had covered about 95% of the affected amount, with the remaining 5% consisting of less liquid tokens that take longer to source; Binance said it is working with industry partners to acquire those assets.

Earlier BlockTelegraph coverage documented Binance outflows after the hack and the wallet permissions reported in another incident. A separate report tracks stolen funds moving into Zcash. Those articles cover distinct reporting and do not establish additional facts about the transfers described here.

The next stated development is Binance’s phased restoration of withdrawals as it works with industry partners to source the remaining less liquid tokens. The analytics firms’ accounts, meanwhile, describe funds still moving through linked addresses, conversions and mixing transactions.