North Korea has denied allegations that it was behind the record $6.3bn hack of the cryptocurrency exchange Binance, calling the claims "absurd rhetoric" and a "grave political provocation" as investigators traced the stolen funds across multiple blockchains.

Kim Yo Jong, a senior North Korean official and the sister of leader Kim Jong Un, said on Tuesday that the accusations were another "sinister attempt" by the United States to damage Pyongyang's image, according to state media reports cited by the BBC and CNBC.

The FBI, the Secret Service and private cyber analysts have said North Korea orchestrated the attack, which has been described as the largest crypto heist in history. The FBI has attributed it to a state-backed group it calls TraderTraitor and has asked industry partners to help block transactions linked to the group.

What the blockchain shows

Blockchain analytics firms have been tracing the money since the hack. Elliptic said the stolen funds moved through roughly 12,000 wallets and 40,000 transactions across 11 blockchains, with about $2.85bn frozen or seized so far.

Chainalysis reported that North Korea-linked actors began moving stolen funds onto Solana after draining about $500m from staging wallets on Tron. That pattern — quick hops across chains, using bridges and mixers — is characteristic of laundering operations that try to break the trail before exchanges can freeze assets.

The tracing has become the practical front line of the case. Attribution is a political argument; freezing funds is an operational one, and it depends on exchanges and analytics firms moving faster than the launderers.

Why Pyongyang denies it

North Korea has consistently denied involvement in major crypto thefts, even when Western governments and private firms have attributed them. The denials serve several purposes: they deny prosecutors a clean public admission, they create ambiguity for countries that might otherwise enforce sanctions more strictly, and they keep the proceeds usable for longer. "The US has made a trite provocation of linking it with the Democratic People's Republic of Korea again," Kim said, according to the BBC.

The US has accused North Korea of relying on cybercrime to finance its sanctioned economy, a charge Pyongyang rejects. Each new attribution becomes ammunition in that argument, and each denial becomes part of the same dispute.

For the exchange, the priority is different: reassuring customers and recovering what it can. Binance has said it covered most of the losses and resumed withdrawals after the attack.

What happens next

The FBI's request for help blocking transactions is likely to be followed by further sanctions designations and by pressure on exchanges in jurisdictions that do not currently cooperate. Analysts will keep publishing traces, and the launderers will keep adapting.

The wider question is whether attribution still works as a deterrent. North Korea is already heavily sanctioned, so additional designations have limited economic effect. What does have effect is the freezing of assets, which is why the $2.85bn figure matters more than the rhetoric.

For the industry, the case is another argument for stronger custody and monitoring at exchanges. For the investigators, it is a race that will continue for months, with most of the stolen money likely to remain in motion.

The hack has already become a reference point in the broader debate about crypto security, and the denial from Pyongyang does not change the technical trail that analysts say they can see.

The pattern is familiar to sanctions investigators. North Korea has been accused of a series of crypto thefts in recent years, and Western governments say the proceeds help fund programmes that sanctions are meant to constrain. Because the country is already heavily sanctioned, new designations have limited additional effect, which is why the operational response — tracking, freezing and blocking transactions — matters more than the diplomatic one.

The scale of this case explains the attention. Moving $6.3bn through 11 blockchains is not a single transfer but thousands of small ones, routed through wallets, bridges and exchanges in different jurisdictions. Each hop creates a record and each jurisdiction creates a delay, and the launderers rely on both. The $2.85bn that Elliptic says has been frozen or seized represents the portion where investigators and exchanges moved faster than the money.

For Binance, the priority is recovery and confidence. For the FBI, it is attribution and disruption. For Pyongyang, the denial is part of the same contest: an accusation it rejects is harder to enforce against if enough countries decline to act on it. None of that changes what the blockchain shows, but it changes how quickly the remaining funds can be moved, and who is willing to help move them. Analysts expect further tracing updates in the coming days, and exchanges will keep freezing wallets as investigators identify them among the remaining stolen funds.

The denial follows the record Binance hack and comes as state-linked cyber campaigns keep surfacing, from the reported plot targeting Nvidia's Jensen Huang to the hoax threat emails sent to UK schools.