North Korea has dismissed the FBI's accusation that its hackers stole more than $6 billion from Binance, calling the charge “an absurd rhetoric and nothing new.”

The remark was made by Kim Yo Jong, sister of leader Kim Jong Un and a department director of the Workers' Party of Korea's Central Committee, in a press statement issued on November 2 and carried by state news agency KCNA.

Kim Yo Jong calls the accusation a grave political provocation

“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” Kim said in the statement, describing the charge as “a grave political provocation against the DPRK.”

Kim linked the accusation to last year's Bybit hack, which she said Washington had also tried to blame on Pyongyang. The February 2025 Bybit theft, estimated at roughly $1.5 billion, was attributed by analysts and U.S. agencies to North Korean-linked hackers. She pointed to the U.S. plan to hold confiscated cryptocurrency as a strategic reserve, arguing that a look at who gets the stolen funds back “may get a clue about who is behind the hacking incident.” The reserve she referenced stems from a March 2025 executive order directing the U.S. government to retain cryptocurrency forfeited in criminal and civil cases rather than sell it.

Pyongyang has “issues to reconsider in diverse aspects” over Washington's hostile attitude, Kim said in the statement. It named no specific step and offered no technical rebuttal of the attribution.

Pyongyang's denial meets TraderTraitor evidence from three firms

In an alert published on October 31, the FBI said North Korea “was responsible” for the theft, which took place on or about October 29. The Bureau refers to the activity as “TraderTraitor” and has been working with the Secret Service and IRS-CI, and has observed the attackers convert stolen assets mostly into Ether. U.S. agencies have used the TraderTraitor name since 2022 for North Korean-linked cryptocurrency theft campaigns.

Blockchain intelligence company TRM Labs was among three firms that identified the attack as the work of North Korean operators before the FBI. Chainalysis co-founder Jonathan Levin made the same attribution on X.

The attacker used EIP-7702 on Ethereum to convert a Binance hot wallet into a sweeper under its control, preparing 50 pre-signed authorizations so that one would be valid at execution. EIP-7702, live since Ethereum's May 2025 Pectra upgrade, lets ordinary wallets temporarily execute smart-contract code.

Binance estimated the loss at about $6.3 billion, while Elliptic called it the biggest theft of its kind, estimating the loss at $6.43 billion.

According to Cryptopolitan, the FBI has also requested THORChain node operators and other DeFi services to block wallets associated with the stolen funds. The list includes 608 Ethereum addresses, 19 Bitcoin addresses, and a single Solana address. Because THORChain and similar protocols are run by independent node operators, such requests rely on voluntary cooperation rather than direct control.

Analyst SomaXBT estimated that about $242 million moved through Tron in two days, with about $140 million of it funneled through cross-chain services such as Relay, THORChain, Chainflip and Symbiosis.

Microsoft Threat Intelligence said last week that North Korean groups were targeting crypto exchanges.

Binance has frozen about $3 billion of stolen funds. On November 2, the exchange said it had funded about 95% of the amount involved from its own pocket. The path of the remaining stolen funds through cross-chain services, and whether further freezes or block requests follow, are the next details to watch.