North Korea has denied responsibility for the USD 6.3 billion cryptocurrency theft at Binance, dismissing the FBI's attribution of the attack as "absurd rhetoric." The denial came as the world's largest crypto exchange reported that customer outflows had normalized following the incident.

Binance holds balances that customers can withdraw at any time, and that ability to withdraw funds is widely regarded as the real capital of an exchange. If an exchange suspends withdrawals, pressure to pull funds builds. Binance disclosed the theft on October 29, 2026, and initially froze withdrawals for more than two days. Analytics firms have since largely reconstructed the technical sequence of events. The precedent is the USD 1.5 billion hack at Bybit in February 2025 — at the time the largest crypto theft on record — in which the FBI likewise named North Korea as the attacker; the Binance case is therefore about four times as large. By November 2, customers had pulled a net USD 4.72 billion from the platform. Pyongyang's response to the FBI attribution, issued over the weekend, came on Tuesday.

Pyongyang calls the FBI attribution "absurd rhetoric"

Over the weekend, the FBI, the federal police agency of the United States that periodically attributes major cyberattacks to state actors, held North Korea responsible for the theft of more than USD 6 billion in crypto assets. The analytics firm TRM Labs had earlier attributed the attack to North Korea with high confidence. Pyongyang replied through the state news agency KCNA.

Kim Yo Jong, the influential sister of leader Kim Jong Un and a party official, called the US claim "absurd rhetoric and nothing new." In her account, the FBI seeks to brand the DPRK a "cyber criminal state" on the basis of information that a hacker group "backed" by the DPRK took part.

"It is a grave political provocation against the DPRK that the US misleads the international public as if all cybercrimes in different parts of the world were our acts," she said.

Kim Yo Jong added that North Korea had "things to reconsider" in light of US hostility, without specifying what. Pyongyang has so far not responded to offers made this year by President Donald Trump to resume summit diplomacy, and the country denies any link to crypto theft or other cybercrime as a matter of principle.

Analysts in Seoul noted the speed of the reply. In their view, the unusually fast reaction likely reflects concern in Pyongyang that the attribution could bring tougher measures against the regime's suspected sources of revenue. For now, an official attribution stands against a state denial.

Binance sees outflows normalized after 24 hours

Co-CEO Richard Teng commented on the state of the exchange at Hong Kong Fintech Week. Withdrawals spiked in the first 24 hours, he said, after which the situation "pretty much normalized." Binance is in "very strong financial shape," Teng added, and has replenished 95% of the affected tokens. "We can cover that. We are able to do so," the executive said.

Besides the cumulative net outflow of USD 4.72 billion, the exchange cites a relative figure: since withdrawals resumed, the net outflow has equaled only about 3% of platform assets. Analysts view this as relatively moderate and as a sign that customer trust has largely held. Binance had frozen withdrawals for more than two days and gradually reopened them beginning November 1. In a post on X, the exchange later reported that hourly deposits now exceed withdrawals, which it said reflects improved user activity and stabilized flows.

Maksym Repa, Head of DeFi at the Bitcoin finance protocol Lombard, also viewed the limited price reaction as a sign of maturity. In his assessment, investors distinguished between a security failure at a centralized exchange and a problem with the Bitcoin network.

Notably, Binance is offering financial incentives while reporting stable flows. Since early November, a "Community Appreciation Campaign" has offered fee discounts and rewards, targeting users with cumulative trading volume of USD 10,000 or more. In addition, certain yield products pay up to 10% APR. The campaign ends on November 21, 2026.

The normalization nevertheless remains a self-report by the exchange. In early November, Binance completed a cryptographic proof of reserves for ten assets that customers can verify themselves. Its cutoff date, however, is October 31, meaning it does not capture the outflows that occurred after withdrawals resumed. Nor does it replace a third-party audit.

How crypto theft funds weapons programs in North Korea

Analysts see crypto theft as a key source of funding for North Korea's weapons programs, and cybersecurity experts rank the country's hackers among the most prolific crypto thieves in the world. Part of the appeal is structural: cryptocurrencies can cross borders without passing through banks, making them harder to reach with conventional, bank-based financial controls. The analytics firm Elliptic estimates their haul for 2026 at USD 7.6 billion, more than in any previous year. South Korea's central bank puts North Korea's gross domestic product for 2025 at 47.18 trillion won (USD 35.09 billion); the Binance theft alone would consequently equal roughly one sixth of the country's economic output.

Chainalysis traced the trend over five years. According to the firm, 89% of all losses from crypto hacks in 2026 have links to North Korea, up from 15% in 2021. Over the same period, the average reported loss per hack rose from USD 50.65 million to USD 185.65 million, an increase of more than 3.6 times. Alec Zebrick, Senior Manager Asia-Pacific Global Services at Chainalysis, described the pattern as big game hunting: the attackers target larger exchanges that require more time and complexity to breach, and in return the haul can be relatively large.

Lim Eul-chul, a professor at the Institute for Far Eastern Studies at Kyungnam University, placed the figures in the context of sanctions. Under the existing sanctions, he said, crypto theft has become one of the main channels for regime survival and weapons development. Additional US measures against wallets, money laundering networks and exchanges could therefore cut off a key source of revenue. Besides the crypto haul, proceeds from activities banned by UN Security Council resolutions also flow into missile and nuclear programs. The link between this revenue source and the quick denial is an interpretation by analysts in Seoul and remains unproven.

Responsibility and the fate of the stolen funds remain open

North Korea's responsibility rests on the FBI attribution and on TRM Labs' own forensics; Pyongyang, by contrast, offers a blanket denial. It remains unclear what lies behind the statement that North Korea has "things to reconsider," as Kim Yo Jong left the remark unexplained.

Teng has announced an investigation report on the hack, but Binance has not yet published it. Recovery is hardest for the portion of the haul that no issuer can freeze. At the end of October, TRM put this portion at about USD 2.4 billion in Bitcoin and Ether, with the analytics firm also expecting cross-chain bridges (protocols that move tokens between blockchains), swap services and over-the-counter dealers (firms that trade large volumes outside public order books) to serve as the next laundering stops.