SEOUL/SINGAPORE — North Korea has issued a forceful rejection of U.S. allegations that its state-linked hackers carried out the largest cryptocurrency theft in history, a $6.3–6.43 billion raid on Binance, the world’s biggest crypto exchange. In a statement carried by the official Korean Central News Agency (KCNA) around November 2–3, 2026, Kim Yo Jong, the influential sister of leader Kim Jong Un and a senior ruling party official, dismissed the claims as “absurd rhetoric” and a “grave political provocation.”
The Federal Bureau of Investigation (FBI) had announced over the preceding weekend that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. The bureau attributed the attack to TraderTraitor, a North Korean state-sponsored cyber unit previously linked to major crypto heists, including the $1.5 billion Bybit theft in February 2025. Blockchain analytics firms including Elliptic, TRM Labs, and Chainalysis independently assessed with high confidence that the same actors were behind the Binance operation, citing on-chain patterns, infrastructure overlaps, and operational tradecraft consistent with prior North Korean campaigns.
Kim Yo Jong’s response framed the accusation as part of a broader U.S. effort to brand the Democratic People’s Republic of Korea (DPRK) a “cyber criminal state” and to mislead international opinion by attributing cybercrimes worldwide to Pyongyang. “The FBI is trying to brand the DPRK as a ‘cyber criminal state,’ claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the incident,” she said, according to KCNA. “But the US assertion is absurd rhetoric and nothing new. It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.” She added that North Korea’s consistent policy is to oppose all malicious acts in cyberspace and suggested the allegations demonstrated ongoing U.S. hostility, raising questions about future diplomatic engagement.
The denial follows a familiar pattern. North Korea has long rejected Western attributions of cyber operations, including earlier crypto thefts. The statement came as Binance moved to stabilise its platform and as investigators continued tracking the movement of the stolen funds.
The Scale and Mechanics of the Attack
On October 29, attackers drained approximately $6.3–6.43 billion in cryptoassets from Binance hot wallets across roughly 10–11 blockchains. Most of the funds were left within about 20 minutes in a highly automated operation. Binance’s own disclosures and independent analyses describe a sophisticated, multi-stage campaign rather than a simple one-off breach.
According to Binance and subsequent reporting, the intrusion began months earlier. Attackers used a fake employment scheme—a known North Korean tactic—to target at least one engineer or DevOps employee. The employee was approached through legitimate job platforms with a fabricated opportunity, progressed through multiple interview rounds with a fictitious company, and was eventually induced to download a coding assignment or related file containing malware. This gave the attackers an initial foothold on a company device. From there, they expanded access, compromised additional systems or credentials, and ultimately leveraged an internal wallet-signing or AI-related service to authorize unauthorized withdrawals. Binance stated it found no evidence that private keys themselves had been leaked, pointing instead to compromised operational access.
The company detected large abnormal transfers, began investigating, and worked rapidly with partners, including stablecoin issuers such as Tether and Circle, as well as other blockchain entities, to freeze assets. Roughly $2.7–2.85 billion (around 44 per cent of the total) was frozen or seized in the critical early window. Binance suspended withdrawals, pledged to cover all customer losses from its own reserves (reporting it had set aside more than $6.3 billion for this purpose), and began a phased resumption of services. By early November, co-CEO Richard Teng indicated that asset outflows had normalised and that the exchange remained in “very strong financial health.” The company also launched efforts to reassure and attract users amid the temporary disruption.
Elliptic and other firms tracked the subsequent laundering. In the first days, the attackers used roughly 12,000 wallets and more than 40,000 transactions across 11 blockchains, creating new wallets at a rapid automated pace. Funds were split, bridged between chains (notably involving Tron, Ethereum, Solana, Bitcoin, and others), and subjected to increasingly complex techniques, including self-minted tokens, chained bridges, lending-protocol manoeuvres designed to break simple traces, and limited early mixing of bitcoin. As of early November reporting, a substantial portion—roughly $3.1–3.2 billion or more—remained in addresses still linked to the theft, predominantly in bitcoin and ether, while smaller amounts continued to move. Analysts noted that the bulk of the still-controlled funds was likely still held by the perpetrators, with some portions potentially entering Chinese money-laundering networks previously associated with North Korean operations. Negligible amounts had been fully cashed out at that stage.
Attribution, Precedent, and North Korea’s Crypto Track Record
U.S. authorities and private blockchain intelligence firms converged quickly on TraderTraitor. The group is described as an elite, financially focused North Korean unit with roots in earlier APT38-style operations and connections to the broader Lazarus Group ecosystem. It has specialised in targeting crypto firms through social engineering, supply-chain and insider-style compromises, and rapid, large-scale fund extraction and obfuscation. The Bybit heist of 2025, also attributed to TraderTraitor by the FBI, shared operational similarities.
North Korea has turned cryptocurrency theft into a significant revenue stream under international sanctions that constrain its conventional economy. Estimates vary, but blockchain firms have reported that the regime and its linked actors have stolen several billion dollars in crypto over recent years. Elliptic assessed that North Korea had stolen cryptocurrency worth $7.6 billion in 2026 alone—more than in any previous year—prior to or including the impact of the Binance incident, depending on exact cutoffs. These proceeds are widely assessed by U.S., South Korean, and independent analysts to help fund the country’s nuclear and missile programs, as well as elite patronage and sanctions-evasion activities.
Pyongyang’s consistent denials of involvement in specific cyber operations have not prevented the accumulation of technical and intelligence indicators that Western governments and private firms treat as persuasive. Attribution in cybercrime is rarely based on a single piece of evidence; it typically rests on a combination of malware tooling, infrastructure reuse, operational patterns, timing, and human intelligence. In this case, the combination of on-chain behaviour matching prior TraderTraitor activity and the FBI’s formal public attribution carried significant weight in industry and government circles.
Binance’s Response and Industry Impact
Binance’s decision to fully cover losses from company funds was intended to protect users and limit broader contagion in an industry still working to build mainstream trust. The temporary suspension of withdrawals and the subsequent phased reopening across networks tested liquidity and user confidence. Net outflows reached several billion dollars in the immediate aftermath before stabilising, according to company statements. The episode renewed scrutiny of operational security practices at major exchanges, particularly around employee device security, internal tooling privileges, social-engineering defences, and the speed of cross-industry freezing coordination.
The incident also highlighted the dual-use nature of blockchain transparency and complexity. While every transaction is recorded and ultimately traceable in principle, the sheer volume of wallets, bridges, and novel obfuscation techniques creates a temporary window during which funds can be dispersed and layered. Private analytics firms play a central role in real-time tracking and in providing leads to law enforcement and compliant platforms. Freezing efforts by stablecoin issuers and other centralised chokepoints proved partially effective in the critical early hours, recovering a substantial fraction of the total.
Geopolitical and Diplomatic Dimensions
Kim Yo Jong’s statement explicitly linked the cyber attribution to broader U.S.-North Korea relations. At the time of the denial, Pyongyang had remained largely silent on U.S. President Donald Trump’s reported interest in resuming high-level diplomacy. The accusation, she suggested, gave North Korea “issues to reconsider” regarding U.S. hostility. Analysts interpreted the language as both a rejection of the specific claims and a signal that cyber attributions could complicate any future engagement.
The episode underscores the growing intersection of cybercrime, sanctions enforcement, and great-power competition. Cryptocurrency has provided sanctioned actors with a relatively accessible means of generating hard-currency revenue outside traditional financial systems. At the same time, the public and private sectors have developed increasingly sophisticated capabilities to attribute, freeze, and disrupt such flows. The Binance case is likely to accelerate further investment in those capabilities, tighter industry information-sharing, and renewed calls for regulatory clarity around exchange security standards.
What Remains Uncertain
Several key questions remain open as of early November 2026. The precise chain of custody of the unfrozen funds, the extent to which any portion has successfully been converted to fiat or integrated into broader laundering networks, and the full scope of any additional compromised systems or individuals at Binance are still under investigation. North Korea’s denial is categorical, yet it has not been accompanied by alternative explanations or technical rebuttals of the on-chain and intelligence evidence presented by U.S. authorities and analytics firms. Independent verification of state direction versus autonomous operation by regime-linked groups is inherently difficult given the closed nature of the North Korean system.
Binance continues its internal review and has emphasised the multi-month nature of the campaign and the sophistication of the social-engineering component. Industry participants are watching closely for further freezes, recoveries, or indictments. For the broader crypto sector, the episode serves as a high-stakes reminder that even the largest platforms remain vulnerable to determined, well-resourced adversaries who combine human targeting with technical exploitation.
The $6.3 billion Binance theft stands as the largest known cryptocurrency heist to date and one of the largest financial crimes of any kind in recent memory. North Korea’s swift and categorical denial has drawn a clear line of contestation. Whether the technical and intelligence case continues to solidify, how much of the remaining funds can ultimately be recovered or disrupted, and whether the incident affects the diplomatic temperature on the Korean Peninsula will shape the next chapters of this story. For now, the known facts centre on a record-scale compromise of a major exchange, rapid attribution by the FBI and leading analytics firms to a North Korean unit, a substantial early recovery effort by the industry, and Pyongyang’s rejection of responsibility as politically motivated.
