North Korea rejected the FBI’s attribution of an Oct. 29 Binance theft as Elliptic estimated the stolen assets at $6.43 billion and mapped their movement across 11 blockchains.
Kim Yo Jong, department director of the Central Committee of the Workers’ Party of Korea, called the U.S. assertion “absurd rhetoric and nothing new” in an English-language statement bearing a Korean Central News Agency (KCNA) dateline. The Federal Bureau of Investigation (FBI) said Oct. 31 that North Korea was responsible for stealing more than $6 billion in virtual assets and identified the activity as TraderTraitor. The FBI’s finding follows earlier EconoTimes reporting on TRM Labs’ attribution of the Binance theft to North Korea-linked hackers.
Binance put its loss at about $6.3 billion in an Oct. 30 update. Elliptic said its tracking through 3:45 a.m. EST (08:45 UTC) Nov. 2 covered about 12,000 wallets and more than 40,000 transactions in less than four days. Elliptic said blockchain records trace asset movements but do not directly identify who controlled the addresses.
Using values from about 2 a.m. EST (07:00 UTC) Nov. 2, Elliptic reported $2.85 billion in frozen or seized assets and about $3.24 billion in addresses linked to the theft. A $340 million gap remains between those balances and Elliptic’s $6.43 billion theft estimate; the firm did not reconcile it. Elliptic assessed that only a negligible share had likely been converted to cash by then.
At 1:02 a.m. EST (06:02 UTC) Nov. 2, about 28 Bitcoin (BTC), worth $2.2 million, had passed through 18 coinjoin transactions, Elliptic said. The firm described early movement involving token swaps and transfers between blockchains. It said stablecoin issuers can block some assets, while Ether (ETH) and Bitcoin lack a central issuer with that ability.
Binance said Nov. 1 that company resources had covered about 95% of the affected amount; the remaining 5% consisted of less-liquid tokens. The exchange said it would absorb the financial impact rather than pass losses to users. Binance also said its investigation first pointed to a laptop that may have been compromised before it found other breach points. It said it found “no evidence that wallet private keys were leaked” and plans to publish technical findings when the investigation is complete.
Elliptic’s comparison with the February 2025 Bybit theft separated laundering time from cash-out time: the firm said 499,000 Ether was laundered over 10 days, while proceeds took months to convert to cash. Elliptic projected that converting and cashing out Binance-linked assets through over-the-counter brokers could also take several months.
