Analytics firms say laundering of $6.3 billion stolen from Binance has begun

More than half of the stolen funds could not be frozen

Stablecoin providers and others quickly froze about $2.8 billion of the assets stolen from cryptocurrency exchange Binance last week. But analytics firms said North Korea had already begun laundering the proceeds by routing them through different blockchain networks. More than half of the $6.3 billion stolen during the hack could not be frozen, which gave North Korea’s cybercriminals time to launder the money.

Chainalysis said thousands of transactions in a short period suggest the attackers may be using automation to obscure the funds’ origins. Moving the stolen cryptocurrency quickly can also result in price fluctuations and high transaction fees, leading to losses of millions of dollars, and brokers will charge high fees to launder the illicit money.

In the 2025 Bybit hack, North Korea took 10 days to swap stolen assets into bitcoin and then several months to cash them out through suspected Chinese over-the-counter trading services, according to analytics firm Elliptic. The Binance attackers are also expected to swap the funds for bitcoin in many small transactions and cash them out through brokers over months, which means the funds would likely be available for the government around next year.

Chainalysis said Pyongyang was responsible for 89% of crypto hacking losses this year, a sharp rise from 15% in 2021. The Binance hack, alleged to have been carried out by North Korean cybercrime unit “TraderTraitor,” was the largest such heist in history.

The FBI said in recent days that North Korea carried out the record-breaking $6.3 billion cryptocurrency theft from Binance last week, and Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the involvement on Tuesday, calling the accusation “absurd rhetoric.” In a statement, Kim said the United States was spreading misinformation by pinning the blame on North Korea for both the Binance heist and last year’s $1.5 billion Bybit hack. “It’s a grave political provocation,” she said. “The U.S. misleads the international public opinion as if all the cybercrimes in different parts of the world are our deeds.”

Kim nevertheless acknowledged that the hack was “extra-large” but maintained that the United States was spreading misinformation. She called the FBI’s accusation a “sinister attempt to damage the international image” of North Korea.

The swift rebuttal by a figure as powerful as Kim’s sister is unusual. North Korea rarely responds to accusations of involvement in cybercrime, and when it does, such a statement is typically handled by working-level officials, said Hong Min, a senior researcher at the Korea Institute for National Unification, a South Korea-funded think tank. “She doesn’t want the U.S. to reinforce North Korea’s image as an illicit actor,” he said. Analysts said the unusual, high-level denial was designed to push back against Western depictions of North Korea as a rogue state.

North Korea has deepened its ties with Russia and China in recent years and strives to be recognized as a formidable nuclear power.

Analysts and Western officials said North Korea uses proceeds from such thefts to fund its weapons programs. Western officials said North Korea’s crypto hacking provides about half of its foreign-currency earnings and funds roughly half of its missile program.

Once funneled into North Korea’s coffers, the funds will bankroll the country’s military modernization drive. In recent weeks, Pyongyang has been testing newer weapons systems, including cluster bombs, a multiple-rocket launcher designed to carry nuclear warheads and a cruise missile mounted with a warhead that disperses submunitions over a wide area.

Reporter note: Dasl Yoon is a reporter for The Wall Street Journal in Seoul, where she covers politics, diplomacy and security on the Korean Peninsula. She specializes in North Korea’s weapons programs, its growing cybertheft operations funding the regime, and South Korea’s defense exports. She was named a finalist for the 2025 Livingston Awards for her reporting. For her work tracking the deployment of North Korean troops to Russia, she shared in the team entry that won the Overseas Press Club’s Hal Boyle Award for “The Russian Way of War.”