North Korea denies the Binance hack, but 44% of the loot is already frozen

North Korea has rejected the FBI's claim that it hacked Binance for $6.43 billion, but the market cares about something else. How much of the money is already locked, and how much could still reach the sell side? That decides whether crypto holders feel extra pressure on prices.

Pyongyang calls the FBI's version a provocation

Kim Jong Un's sister, Kim Yo Jong, called the American findings a "grave political provocation". Yonhap reported her statement, citing the state news agency KCNA. On Saturday the FBI pinned the theft on TraderTraitor, the group previously linked to the $1.5 billion Bybit hack in February 2025. Analysts at TRM Labs and Chainalysis reached the same conclusion last week.

Kim Yo Jong went further and hinted that Washington itself stands to gain from any recovery, since the Trump administration plans to hold confiscated crypto in a strategic reserve. She offered no evidence. Binance did not answer the BBC's question about North Korea's role. For the market this war of words changes little, because the money moves regardless of statements.

A new wallet every 25 seconds, but freezes were faster

According to Elliptic, in under four days the attackers spread the funds across about 12,000 wallets on 11 blockchains and ran more than 40,000 transactions. That works out to a new wallet every 25 seconds. On Tron, the main route, activity peaked at 1,300 transactions an hour. Many people jumped to AI agents, but analysts pushed back because timing is fixed, amounts are preset, retries are blind, and the pauses look like a human work schedule.

Stablecoin issuers turned out to be quicker. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet, and Circle froze all $823 million in USDC before the first swap. As a result $2.85 billion, or 44% of the $6.43 billion, has been frozen or seized. After the Bybit hack that figure was about 3%.

Where the $786 million that got away went

Before the freezes landed, the attacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on Aave against another 59.9 million USDT, and turned 234 million USDT into TRX. About $786 million in stablecoins slipped out in total.

Most of the money still sits idle. Roughly $3.24 billion remains in addresses tied to the hack, mostly ether and 18,270 Bitcoin that have not moved since the day of the attack. Chainalysis estimates that more than $1 billion in ether and about $1.42 billion in bitcoin saw little movement. Elliptic believes these funds are most likely still held by North Korea, while what is already being laundered may have reached Chinese networks.

Why the selling will stretch over months

Following the Bybit script, Elliptic expects the hackers to swap ETH for BTC in small batches and cash out through OTC brokers over several months. For the market that is more a steady background drag than a one-off dump on exchanges, so the scheme does not promise a sharp crash. Bitcoin trades near $77,000, and according to CoinDesk it is held down by ETF outflows and the US elections, not by the theft itself.

Further freezes will be harder.

• ETH and BTC cannot be frozen, so new blocks depend on centralized services where the money has to surface sooner or later.
• Chainalysis expects the flow to shift to bridges, instant exchanges and swap services once the usual channels cannot take the load.
• About $16 million has already landed in addresses holding proceeds of September's Bitget exploit.

Binance: outflows are slowing

Binance said net withdrawals since Sunday reached $4.72 billion against assets of about $157 billion. The company called that a relatively limited share. Late Monday, Eastern US time, hourly deposits began to exceed withdrawals, and the exchange restored withdrawals for dozens more tokens on Ethereum and Solana.

The exchange covered about 95% of the stolen assets from its own funds, and the rest sits in less liquid tokens that take longer to buy. Holders of the ten largest tokens can now verify that their balances are fully backed through a zero-knowledge proof of the October 31 reserves snapshot. Binance promises a wider snapshot on Wednesday.

For scale, net outflows in the first nine and a half hours after withdrawals reopened came to $3.64 billion, or 2.1% of assets. The pace dropped noticeably after that. It affects liquidity: when the largest exchange in the world absorbs an outflow of a few percent without halting operations, panic in the spot market does not grow into a broader sell-off.

What to watch next

Pyongyang's statement changes nothing in the laundering chain, so other signals deserve attention: new addresses on the FBI's list, any move of the 18,270 BTC or of ether from dormant addresses, and large sums showing up on OTC desks. If the money starts to exit, the first traces will appear there. Wednesday's reserves snapshot will show whether Binance keeps its promises.