Binance is expanding withdrawal access, while blockchain researchers say most stolen funds have yet to be converted into spendable money.
MARKET INSIDER — North Korea rejected the FBI’s attribution of the approximately $6.3 billion Binance theft on Tuesday as investigators continued tracking stolen cryptocurrency across thousands of wallets. Kim Yo Jong, sister of North Korean leader Kim Jong Un, accused Washington of politicizing the incident. Separately, Binance announced plans to reopen withdrawals for additional assets and networks. The developments highlight three distinct parts of the crisis: identifying those responsible, recovering stolen funds and restoring customer access. Progress on the latter does not mean the recovery operation is complete, even as researchers report substantial assets frozen or seized.
Key Highlights
- Pyongyang rejected the FBI’s attribution of the attack to North Korea-linked TraderTraitor.
- Elliptic estimates that approximately $2.85 billion has been frozen or seized, while billions remain in addresses associated with the theft.
- Binance says it has covered about 95% of affected assets and is progressively expanding withdrawals.
Pyongyang challenges the FBI’s findings
Kim Yo Jong described the U.S. accusation as a “grave political provocation,” according to Yonhap, citing North Korea’s state-run Korean Central News Agency.
She accused the FBI of attempting to portray North Korea as a state responsible for cybercrime and said Washington was misleading international opinion. Her statement followed the bureau’s attribution of the theft to TraderTraitor, a North Korean state-sponsored cyber operation.
The denial adds a diplomatic dispute to an investigation already spanning multiple blockchains and jurisdictions. It does not change the observable movement of the stolen assets, although identifying wallet activity and establishing who controls those wallets remain separate analytical tasks.
The FBI’s attribution is an official U.S. assessment. Blockchain firms including Chainalysis and Elliptic have also linked the operation to North Korean actors.
Thousands of wallets complicate the investigation
According to Elliptic’s report, the first four days of activity involved roughly 12,000 wallets across 11 blockchains and more than 40,000 transactions.
The firm described extensive automated transfers, asset conversions and movements between networks. Much of the early activity involved Tron, before funds moved onto Ethereum and other blockchains.
These transfers multiply the records investigators must examine. They do not necessarily mean the funds have disappeared from view or successfully entered the conventional financial system.
Elliptic also identified initial bitcoin mixing activity, involving approximately 28 BTC worth $2.2 million as of early Monday. That updates earlier reporting in which investigators said they had not yet observed mixers being used. Mixing can complicate transaction tracing, but does not establish that the assets have been cashed out.
Chainalysis separately reported a further phase of laundering after more than $500 million moved through intermediary wallets on Tron, according to the original CNBC report.
Moving cryptocurrency is not the same as cashing out
The distinction matters when assessing the attackers’ progress.
A transfer between wallets changes where cryptocurrency is held. An exchange into another token changes the asset being tracked. Neither necessarily produces money that can readily be spent outside the cryptocurrency ecosystem.
Elliptic said only a negligible amount appeared to have been cashed out. Most observed activity involved transfers or conversions between digital assets.
That leaves investigators with potential opportunities to identify and intercept funds. However, opportunities depend on where assets move, which intermediaries handle them and whether those parties can cooperate with authorities.
Public transaction records can support tracing, while recovery may require control of private keys, cooperation from a custodian or action by a token issuer.
Stablecoin controls have limited part of the damage
Stablecoin issuers played an important role in restricting access to stolen assets.
The attackers converted some stablecoins into other cryptocurrencies before issuers could intervene. Elliptic estimated that roughly $786 million was converted before freezes took effect.
Native bitcoin and ether lack a central issuer with the same ability to blacklist tokens. That makes them harder to immobilize through issuer action, although assets can still potentially be seized or restricted when they reach cooperative intermediaries.
The use of decentralized exchanges, bridges or a particular blockchain does not itself indicate criminal activity. In this case, investigators are following assets already associated with the theft.
Recovery figures need careful interpretation
Elliptic valued the theft at approximately $6.43 billion, compared with Binance’s widely cited estimate of roughly $6.3 billion. These figures should remain attributed to their respective sources rather than treated as interchangeable, audited totals.
The firm reported approximately $2.85 billion frozen or seized and roughly $3.24 billion remaining in linked addresses, predominantly in bitcoin and ether.
Those categories should not be used to calculate a definitive final loss. Asset prices change, investigations evolve and funds may move between classifications. Frozen or seized assets also have not necessarily been returned to Binance.
Binance’s reopening follows a separate process
Binance said Tuesday that it would progressively restore withdrawals for additional cryptocurrencies across more networks.
The exchange has also said it covered about 95% of the affected amount, with the remaining 5% comprising less-liquid tokens that take longer to source. It said it was working with industry partners to acquire those assets.
Covering customer assets and recovering the original stolen funds are different processes. The exchange can replenish holdings while investigators continue pursuing cryptocurrency controlled by attackers.
For customers, the immediate test is whether withdrawals function reliably across the restored networks. For the broader market, further clarity will depend on a reconciliation of replaced and recovered assets, disclosure of the security failure and evidence that the underlying vulnerabilities have been addressed.
