North Korea denies role in $6.4 billion Binance hack, calls FBI finding a 'political provocation'
North Korea has denied it was behind the record hack of crypto exchange Binance, rejecting the FBI's finding that North Korean hackers stole more than $6 billion. Kim Yo Jong, sister of leader Kim Jong Un, called the accusation a "grave political provocation" meant to damage her country's image, according to a statement carried by state-run media and reported by Yonhap.
Key points at a glance
- North Korea denies involvement in the Binance theft, calling the FBI's attribution a political provocation.
- The FBI and analytics firms TRM Labs and Chainalysis blame the North Korean group known as TraderTraitor.
- The same group is blamed for the $1.5 billion hack of exchange Bybit in February 2025.
- Analysts say stolen funds are being moved through roughly 12,000 wallets, at a pace of about one new wallet every 25 seconds.
- About $2.85 billion of the $6.43 billion stolen has been frozen or seized, far more than the roughly 3% recovered after Bybit.
Kim Yo Jong calls the accusation a political provocation
"It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds," Kim Yo Jong said in a statement carried by the Korean Central News Agency, according to Yonhap. She described the accusation as a "sinister" attempt to damage North Korea's international image.
Kim also turned the accusation back toward Washington, pointing to the Trump administration's plan to use confiscated crypto as a strategic reserve. She suggested that anyone asking who would end up with "the so-called stolen cryptocurrency" once it is retrieved "may get a clue about who is behind the hacking incident."
What the FBI and analytics firms say
The FBI said on Saturday that North Korean hackers it calls TraderTraitor were responsible for stealing more than $6 billion from Binance. That confirmed the attribution that blockchain analytics firms TRM Labs and Chainalysis made the previous week. The FBI has also attributed the $1.5 billion Bybit hack of February 2025 to the same group. North Korea has denied previous hacking accusations as well, and no independent confirmation of its role is available from the supplied material.
Stolen funds are moving through thousands of wallets
The hackers are laundering the money quickly. According to Decrypt, the funds are being spread across about 12,000 wallets at a rate of roughly one new wallet every 25 seconds — a common laundering technique that splits stolen crypto across many addresses to make it harder to trace.
The movement is uneven. Chainalysis said on November 2 that as of that date, more than $1 billion in ETH (ether, a cryptocurrency) and about $1.42 billion in BTC (bitcoin) had seen limited onward movement, while other stolen funds were moving rapidly across different blockchains. The firm said the pattern so far resembles the "immediate layering" phase seen after past North Korean hacks, but funds repeatedly returning to earlier addresses across thousands of transactions suggest automation.
Chainalysis expects the sheer scale of the theft to "strain the actors' trusted laundering channels," pushing more funds toward bridges, instant exchanges and swapping services.
Binance reports withdrawals stabilizing
Binance did not answer the BBC's questions about North Korea's alleged involvement. A company spokesperson told the outlet that a net $4.72 billion had been withdrawn since withdrawals resumed on Sunday, which it called a "relatively limited portion" of the exchange's roughly $157 billion in total assets. By 10 p.m. ET on Monday, the company said hourly deposits were exceeding withdrawals, "reflecting improving user activity and stabilizing flows," and it has restored withdrawals for dozens more tokens on Ethereum and Solana.
Binance also said users holding its 10 largest tokens, including BTC, ETH and the stablecoins USDT and USDC (tokens pegged to the US dollar), can now verify their balances are fully backed using a zero-knowledge proof — a cryptographic method that lets the exchange prove its reserves without revealing user data — based on an October 31 snapshot. The company said it has covered about 95% of the stolen assets, with the rest in less liquid tokens that take longer to buy.
What is confirmed and what is not
Confirmed by the FBI and analytics firms: the theft exceeds $6 billion, it is attributed to the North Korean group TraderTraitor, and roughly $2.85 billion has been frozen or seized. Confirmed by Binance: the withdrawal figures, the reserve snapshot and the coverage of about 95% of the stolen assets.
North Korea's denial is a claim by the government itself, made through state media. Its suggestion that the US could be behind the hack is an accusation, not a supported finding. No independent party has verified either side's account of who carried out the attack.
Why this matters for crypto users
This is one of the largest crypto thefts on record, and the recovery rate of about $2.85 billion frozen or seized is far higher than the roughly 3% recovered after the Bybit hack. The pace of laundering matters for exchanges, law enforcement and analytics firms trying to freeze funds before they disappear. For Binance users, the exchange's public reserve proof and recovering deposit flows are the main available indicators of how the platform is holding up.
What happens next
Binance plans to take a wider reserve snapshot on Wednesday. Laundering activity is expected to continue, with Chainalysis anticipating that stolen funds will increasingly move through bridges, instant exchanges and swapping services.
Where this information comes from
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.