North Korea denies role in $6.3B Binance hack, calls FBI claims political

North Korea has denied responsibility for the $6.3 billion Binance cryptocurrency hack, with Kim Jong Un’s sister condemning the FBI’s findings as a political attack against Pyongyang.

Summary

• Kim Yo Jong has rejected the FBI’s accusation that North Korea carried out the $6.3 billion Binance hack.
• The North Korean leader’s sister called the U.S. investigation a “grave political provocation” against Pyongyang.
• The FBI attributed the October 29 theft to TraderTraitor and urged crypto service providers to block linked transactions.
• Elliptic traced stolen funds through approximately 12,000 wallets and more than 40,000 transactions across 11 blockchains.
• Binance has replenished approximately 95% of affected assets while progressively restoring cryptocurrency withdrawals.

In a report published Tuesday, Yonhap News Agency cited a statement carried by the Korean Central News Agency (KCNA) in which Kim Yo Jong rejected the U.S. government’s allegations. She called the accusations a “grave political provocation” and accused Washington of attempting to damage North Korea’s international reputation.

The statement followed the FBI’s October 31 announcement identifying North Korea-linked hacking group TraderTraitor as responsible for the October 29 theft.

Kim Yo Jong rejects FBI claims over Binance hack

Kim challenged the FBI’s attribution of the attack, arguing that Washington was attempting to portray North Korea as responsible for cybercrime incidents worldwide.

“The FBI is trying to brand the DPRK as a ‘cyber criminal state’,” she said, questioning the agency’s assertion that a North Korean-supported hacking organization carried out the theft.

DPRK refers to the Democratic People’s Republic of Korea, North Korea’s official name.

Kim described the accusation as “absurd rhetoric” and called the investigation a politically motivated effort to undermine her country’s standing.

JUST IN: North Korea denies involvement in the $6.3B Binance hack

Kim Yo-jong, sister of leader Kim Jong Un, called the allegations “absurd rhetoric” and accused the U.S. of trying to damage North Korea’s image, despite the FBI and cybersecurity analysts attributing the attack… pic.twitter.com/5rdoJNHxnC

— crypto.news (@cryptodotnews) November 3, 2026

She accused the United States of violating North Korea’s sovereignty in cyberspace, describing Washington’s conduct as a “sinister” attempt to damage its national image.

The statement represents an unusually direct response from Kim to allegations involving cryptocurrency theft, an area where Pyongyang has repeatedly denied involvement.

Kim further questioned Washington’s intentions regarding the recovery of stolen cryptocurrencies.

She referred to U.S. government plans to confiscate illicit digital assets and suggested that whoever eventually receives recovered funds could provide clues about the attack.

However, she presented no evidence identifying an alternative perpetrator.

Kim said North Korea was “closely monitoring” Washington’s actions and warned that Pyongyang had matters to reconsider concerning the U.S. government’s approach.

FBI identifies TraderTraitor in $6.3 billion theft

The FBI’s October 31 alert directly attributed the Binance breach to TraderTraitor, a hacking operation previously associated with North Korean cyber activity.

The agency said the attackers stole more than $6 billion in digital assets from the exchange on October 29.

Working with the U.S. Secret Service and Internal Revenue Service’s Criminal Investigation division, investigators identified cryptocurrency movements associated with the suspected group.

The FBI reported that the attackers were converting stolen assets primarily into Ethereum.

Authorities warned that the funds could subsequently pass through decentralized finance platforms and instant cryptocurrency swapping services.

The alert requested assistance from exchanges, blockchain operators, analytics companies and other digital asset providers.

Specifically, investigators urged those organizations to block transactions linked to wallet addresses identified in the investigation.

Earlier, crypto.news reported that blockchain investigators had connected the theft to TraderTraitor, with TRM Labs expressing high confidence in its attribution.

Binance’s preliminary findings pointed to a compromised engineer’s laptop that may have enabled unauthorized access to its internal infrastructure.

The exchange said it had found no evidence of leaked wallet private keys during its initial investigation.

Elliptic traces stolen funds through 12,000 wallets

Meanwhile, blockchain analytics firm Elliptic released new findings documenting how the stolen cryptocurrencies moved across multiple networks.

Its November 2 investigation estimated the total theft at $6.43 billion, slightly above the $6.3 billion figure commonly cited.

Elliptic identified approximately 12,000 cryptocurrency wallets involved in more than 40,000 transactions across 11 blockchains during the first four days.

According to its analysis, much of the activity initially occurred on Tron, where assets spread across approximately 7,700 addresses.

The attackers subsequently transferred funds to Ethereum through cross-chain bridges, complicating efforts to follow individual transactions.

Elliptic estimated that $786 million in stolen stablecoins had been converted into other cryptocurrencies before issuers could freeze them.

Another $2.85 billion had been frozen or seized, representing roughly 44% of its estimated theft value.

The firm identified approximately $3.24 billion remaining in addresses associated with the incident, primarily in Bitcoin and Ethereum.

Its investigators said only a negligible portion appeared to have been converted into spendable funds.

The tracing activity included approximately 28 BTC transferred through cryptocurrency mixing transactions.

Binance restores withdrawals and replenishes reserves

As investigators continued tracking the stolen assets, Binance reported progress in replacing affected cryptocurrency balances.

On November 2, the exchange completed its latest reserve verification covering ten major cryptocurrencies.

These included Bitcoin, Ethereum, BNB, Solana, USDT, USDC, XRP, USD1, RLUSD and Zcash.

Binance said it had replenished approximately 95% of affected assets using company resources, with less-liquid tokens accounting for the remaining balance.

The exchange had already begun restoring cryptocurrency withdrawals on November 1 after temporarily suspending services following the security breach.

Its first reopening phase covered Bitcoin and selected assets across Ethereum and BNB Smart Chain.

Binance said additional cryptocurrency withdrawals would progressively resume from November 3, subject to operational and security checks.

The exchange has committed to absorbing the financial losses from the attack instead of passing them on to customers.