North Korea denies Binance hack as $3.24b remains in hacker wallets

4 min

North Korea denied US claims that its hackers stole billions from Binance, but on-chain evidence from multiple firms still links the heist to DPRK actors. Elliptic estimates $3.24 billion remains in attacker-controlled wallets, largely in Bitcoin and Ether. First signs of laundering appeared as stolen BTC hit a mixer. BTC fell 1.8% to $76,729, testing the 200-day EMA, and the Crypto Fear & Greed Index dropped to 26 from 37.

What North Korea Said About the Binance Hack

The state news agency KCNA carried comments by Kim Yo Jong after the FBI named TraderTraitor as the culprit:

The claim: the FBI’s attribution is “absurd rhetoric,” a “grave political provocation against the DPRK.”
The motive: Washington aims to brand North Korea a “cyber criminal state.”
The counter-claim: investigators should examine who benefits from “recovered” crypto, implying US involvement.
The warning: Pyongyang will “reconsider issues” in response to a “hostile attitude.”

She also rejected US attribution for the $1.5 billion Bybit hack in February 2025. No supporting evidence for the counter-claims was provided.

NORTH KOREA SAYS CLAIMS THAT IT WAS BEHIND BINANCE HEIST IS "FABRICATION" – KCNA – RTRS

— Tree News (@TreeNewsFeed) November 2, 2026

Attribution: Why Investigators Tie the Hack to North Korea

The FBI and several blockchain analytics teams cite patterns consistent with DPRK operations:

FBI: tracked TraderTraitor converting stolen assets to ether and warned of further laundering.
TRM Labs: “High confidence” attribution to TraderTraitor based on Tornado Cash funding and coordinated transaction signatures used in prior DPRK hacks.
Chainalysis: traced over $500 million through Tron intermediaries before a shift to Solana-based laundering.
ZachXBT: identified Binance and Bitget funds mixed at the same address after routing via THORChain.
Bitget: CEO Gracy Chen reported IPs tied to VPN services used by a DPRK-linked group.

No off-chain evidence has been published, and no court has ruled on the attribution.

Where the Stolen Funds Are Now

Elliptic estimates the haul at $6.43 billion and shows a large portion still under attacker control.

Frozen or seized: $2.85 billion, or 44%, including Tether and Circle freezes.
Still in linked wallets: $3.24 billion, mostly Bitcoin and Ether.
Swapped out of stablecoins: about $786 million converted before freezes.
Mixed so far: about 28 BTC, roughly $2.2 million, across 18 transactions as of early Monday.

Activity pace: about 12,000 wallets across 11 chains in the first four days, one new wallet every 25 seconds. Elliptic expects further conversions into Bitcoin and gradual offloading via OTC brokers and exchanges, implying $3.24 billion in potential supply entering the market over time.

BTC Price: Key Levels Around the 200-Day Average

Price: $76,729 on Binance, down 1.8% in 24 hours. The 200-day EMA stands at $76,502. The post-hack low at $76,326 remains intact after five days. Monday’s rebound stalled at $78,878, below the 50-day EMA at $80,105.

BTCUSDT 1D chart. Source: TradingView

Resistance: $78,878, then $80,105 and $81,971.
Support: $76,502 to $76,326, then $74,968.

Outlook	Trigger	Level to watch
Rebound	A daily close above $78,878	$80,105, the 50-day EMA
Holding pattern	Range between $76,326 and $78,878	Sideways trade if attacker wallets stay inactive
Sell-off	A daily close below $76,326	$74,968, the September 15 low

Implication: the denial does not alter the on-chain risk. Any acceleration of laundering or exchange-bound flows from attacker wallets would likely pressure $76,326 support.