Binance Hack: North Korea Denies Links as $6.43 Billion Trail Expands

Binance Faces a Recovery Test Beyond the $6.43 Billion Theft

Binance entered a critical recovery phase on Nov. 3, 2026, as North Korea denied links to a hack that Elliptic measured at exactly $6.43 billion. For investors assessing crypto platforms and digital-asset infrastructure, the central issue is no longer just the headline loss: it is whether Binance can restore withdrawals while investigators continue tracking assets across fragmented networks.

CNBC reported that Binance had covered about 95% of the affected amount and was sourcing the remaining 5%, which consisted of less liquid tokens. That coverage limits one immediate financial concern, while the phased restoration of withdrawals shows that operational normalization is not complete.

What the Binance Blockchain Trail Shows

Cross-chain laundering is the movement or conversion of cryptocurrency across different blockchains to fragment its transaction history and make tracing harder. Elliptic said North Korea-linked hackers used roughly 12,000 wallets across 11 blockchains during the first four days after the attack.

The same Elliptic analysis counted more than 40,000 transactions during those first four days, with an average of 1 new wallet used every 25 seconds. Those figures matter because investigators, issuers and trading venues must follow a rapidly expanding set of addresses rather than a single linear transfer path.

Initial activity concentrated on Tron, where Elliptic identified distribution across about 7,700 addresses. The firm said at least $147 million moved out of Tron through cross-chain bridges into Ethereum, establishing a route by which assets could shift between network ecosystems.

Elliptic also said roughly $786 million in stablecoins was converted before Tether and Circle froze remaining assets. Converting issuer-controlled stablecoins into cryptocurrencies that cannot be frozen by those issuers changes the recovery mechanism: asset control gives way to blockchain tracing, transaction monitoring and intervention at later transfer points.

North Korea’s Denial Meets Competing Attribution

North Korea rejected the allegations, and Kim Yo Jong called the accusation a “grave political provocation.” She also denounced the FBI’s attribution of the attack to TraderTraitor through comments carried by the Korean Central News Agency.

Kim Yo Jong, the sister of Kim Jong Un, said: “The FBI is trying to brand the DPRK as a 'cyber criminal state'.” Pyongyang’s position directly conflicts with the attribution presented by the FBI and the findings of blockchain analytics firms Elliptic and Chainalysis.

The evidentiary boundary is important. The supplied data does not independently establish who executed the hack, even though Elliptic and Chainalysis linked both the attack and subsequent fund movements to North Korea-linked actors. Investors should separate political attribution from the observable transaction trail and treat each according to its supporting evidence.

The Frozen Funds Change the Loss Equation

Elliptic reported that $2.85 billion, or 44% of the $6.43 billion in Binance stolen funds, had been frozen or seized. Another $3.24 billion remained in addresses linked to the theft, leaving a large monitored pool whose ultimate recovery or disposition was not established.

The distinction between movement and realization is central to the risk assessment. Transfers among wallets, bridges and cryptocurrencies demonstrate control and concealment activity; they do not by themselves show that the assets have been converted into spendable funds.

The supplied evidence does not identify which authorities froze or seized the reported assets. It also does not explain how Binance covered about 95% of the affected amount, so the balance-sheet, liquidity and partner contributions behind that figure cannot be evaluated from the available facts.

A New Laundering Phase Across Tron, Solana and Bitcoin

Chainalysis said North Korea-linked actors entered a new laundering phase after moving more than $500 million through intermediary wallets on Tron. Elliptic said the operation also expanded to Solana, widening the network surface that investigators and market participants must monitor.

Elliptic identified early signs of bitcoin mixing, a transaction method intended to make fund tracing more difficult. As of early Monday, North Korea-linked actors had moved about 28 bitcoin, worth $2.2 million, through 18 mixing transactions.

The bitcoin activity was small relative to the broader amount traced, though its importance lies in the shift in method. If more assets move from identifiable addresses into mixing transactions, the useful checkpoint is the amount entering those transactions and the portion that remains visible, frozen or seized.

Why the Bybit Comparison Matters

Elliptic contrasted the current movement with the $1.5 billion Bybit hack in February 2025. North Korean hackers moved all the stolen ether from that incident within 10 days, while Elliptic said laundering tied to the Binance theft had proceeded more slowly.

That comparison offers a behavioral baseline, not proof of common authorship. A slower path may provide more opportunities for tracking and freezing assets, while continued conversion across wallets, bridges and blockchains can still erode the practical value of a visible trail.

Exposure Across Platforms, Issuers and Networks

• Binance: The platform faces the direct operational test. Its stated 95% coverage is supportive, while the remaining 5% of less liquid tokens and progressive withdrawal reopening keep execution risk active.
• Tether and Circle: These issuers froze remaining stablecoin assets after roughly $786 million had already been converted, demonstrating both the utility and timing limits of issuer-level controls.
• Tron and Ethereum: Elliptic traced transfers from Tron to Ethereum through cross-chain bridges, making bridge activity a central part of the fund-tracing process.
• Solana and bitcoin: Expansion into Solana and the appearance of bitcoin mixing show that the investigation now spans additional assets and transaction structures.

Next Checkpoints for Binance and the Traced Funds

• Withdrawal restoration: Track which additional crypto assets and networks Binance reopens under its progressive restoration plan.
• Coverage completion: Monitor whether Binance acquires the remaining 5% of less liquid tokens through the industry partners it referenced but did not name.
• Asset disposition: Compare future frozen or seized amounts with the reported $2.85 billion and the $3.24 billion still held in addresses linked to the theft.
• Laundering methods: Watch whether activity expands beyond the reported 28 bitcoin and 18 mixing transactions, and whether more funds move through Tron, Ethereum or Solana.

Overall Outlook for Binance’s Recovery

The constructive case rests on three confirmed points: Binance said it had covered about 95% of the affected amount, withdrawals were being progressively reopened, and Elliptic reported that 44% of the stolen funds had been frozen or seized. Together, those facts indicate meaningful financial and operational containment.

The risk case is equally concrete. Billions remained in theft-linked addresses, laundering had spread across multiple blockchains, and the platform still had to source less liquid assets representing the remaining 5%. The next signal is not another attribution statement; it is whether withdrawal access broadens, coverage reaches completion and the frozen-or-seized share rises as the traced funds move.

This article was independently written by OneDayTrading from public reporting. Read the original (CNBC)