North Korea Denies Responsibility for $6.3B Binance Hack, Calls FBI Attribution a ‘Political Provocation’
Key Takeaways
- •The FBI attributed the theft of more than $6 billion from Binance to TraderTraitor, the same North Korean hacking group blamed for the $1.5 billion Bybit hack in February 2025.
- •Kim Yo Jong denied North Korea's involvement, calling the U.S. accusations a grave political provocation and suggesting the ultimate recipients of recovered funds could reveal who was behind the incident.
- •About $2.85 billion of the $6.43 billion stolen, roughly 44%, has been frozen or seized, compared with roughly 3% of the funds taken in the Bybit hack.
- •Chainalysis reported the stolen assets are being moved through about 12,000 wallets at a rate of roughly one new wallet every 25 seconds, in a pattern consistent with the immediate layering phase of laundering.
- •Binance has covered about 95% of the stolen assets, restored withdrawals for dozens of tokens on Ethereum and Solana, and enabled zero-knowledge-proof verification of reserves for its 10 largest tokens.
North Korea has denied responsibility for the hack of Binance, with Kim Yo Jong calling U.S. accusations a “sinister” effort to damage the country’s international image.
The FBI, the U.S. Secret Service and blockchain analytics firms have attributed the theft to TraderTraitor, a North Korean hacking group previously blamed for the Bybit hack. Binance said net withdrawals since Sunday had reached $4.72 billion, although hourly deposits began exceeding withdrawals late Monday.
North Korea rejected U.S. findings that it was behind the record Binance hack — the largest theft recorded from a cryptocurrency platform — describing the FBI’s attribution as a “grave political provocation,” Yonhap reported Tuesday.
“It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, the sister of leader Kim Jong Un, said in a statement carried by the state-run Korean Central News Agency. She called the accusation a “sinister” attempt to damage North Korea’s international reputation.
Kim also directed blame toward Washington, pointing to the Trump administration’s plan to use confiscated cryptocurrency as a strategic reserve. Anyone who examines who will ultimately receive “the so-called stolen cryptocurrency” after it is recovered “may get a clue about who is behind the hacking incident,” she said.
The FBI said Saturday that North Korean hackers known as TraderTraitor were responsible for stealing more than $6 billion from Binance. The statement confirmed an attribution made the previous week by blockchain analytics firms TRM Labs and Chainalysis. The FBI attributed the $1.5 billion hack of crypto exchange Bybit in February 2025 to the same group — until the Binance theft, the largest on record in the industry. North Korea has denied previous accusations of hacking.
Stolen funds move through thousands of wallets
The hackers have been moving the stolen assets rapidly. North Korea is laundering the funds at a rate of roughly one new wallet every 25 seconds, across about 12,000 wallets, Decrypt reported Monday. About $2.85 billion of the $6.43 billion stolen — roughly 44% of the total — has been frozen or seized, compared with roughly 3% of the funds taken from Bybit.
The stolen assets are not all moving at the same pace. As of Monday, more than $1 billion in ETH and approximately $1.42 billion in BTC had seen limited onward movement, while other funds were moving rapidly across chains, Chainalysis said.
The activity so far is broadly consistent with the “immediate layering” phase observed after previous North Korean hacks, the firm said. Layering is the stage of a laundering operation in which stolen funds are rapidly shuttled between addresses through repeated transactions to obscure their origin. Funds repeatedly returning to earlier addresses across thousands of transactions indicate the use of automation, according to Chainalysis. The scale of the theft is expected to “strain the actors’ trusted laundering channels,” pushing the funds toward bridges, instant exchanges and swapping services.
Chainalysis posted the following update on X on Nov. 2:
As of Nov 2, over $1B in ETH and ~$1.42 billion in BTC stolen from Binance have seen limited onward movement since the theft. Other stolen funds are moving rapidly across chains. These funds are not all progressing through the laundering process at the same pace. pic.twitter.com/ZEVCZzCDRM — Chainalysis (@chainalysis) November 2, 2026
Binance works to restore normal operations
Binance did not respond to the BBC’s questions about North Korea’s alleged involvement. A company spokesperson told the outlet that a net $4.72 billion had been withdrawn since withdrawals resumed Sunday, describing the amount as a “relatively limited portion” of Binance’s total assets, which stood at about $157 billion.
By 10 p.m. ET Monday, hourly deposits were exceeding withdrawals, “reflecting improving user activity and stabilizing flows,” Binance said on X. The exchange has since restored withdrawals for dozens more tokens on Ethereum and Solana.
Binance also said Monday that users holding its 10 largest tokens, including BTC, ETH, USDT and USDC, could verify that their balances were fully backed. The verification uses a zero-knowledge proof — a cryptographic technique that lets an exchange demonstrate its reserves without exposing individual account data — based on the exchange’s Oct. 31 reserves snapshot.
The company said it had covered about 95% of the stolen assets. The remaining assets consist of less liquid tokens that take longer to purchase, Binance said, adding that it planned to take a wider reserves snapshot Wednesday.
Primary sources: Yonhap, FBI attribution report covered by Decrypt, TRM Labs and Chainalysis analysis, Chainalysis on X, BBC, Binance on X.
