North Korea Denies Binance Hack as FBI Pins $6.3B Theft on Pyongyang

North Korea has publicly rejected the FBI's conclusion that it was behind the record theft of more than $6 billion from Binance, with Kim Yo Jong — sister of leader Kim Jong Un — calling the attribution a "grave political provocation" in a statement carried by state outlet KCNA and reported by Yonhap on Tuesday.

The FBI said Saturday that a North Korean group it calls TraderTraitor was responsible, confirming earlier attributions by blockchain analytics firms TRM Labs and Chainalysis, per Decrypt. The same group was blamed for the $1.5 billion Bybit hack in February 2025. Kim called the claim a "sinister" attempt to damage North Korea's image and turned it back on Washington, suggesting that whoever ends up with "the so-called stolen cryptocurrency" — a nod to the Trump administration's plan to hold confiscated crypto as a strategic reserve — offers "a clue about who is behind the hacking incident."

On the recovery side, Binance told the BBC that net withdrawals since Sunday reached $4.72 billion, which a spokesperson characterized as a "relatively limited portion" of roughly $157 billion in total assets. The exchange tweeted that by 10 p.m. ET Monday, hourly deposits had begun exceeding withdrawals, and it has since restored withdrawals for dozens more Ethereum and Solana tokens.

Key facts

• FBI, Secret Service and analytics firms attribute the >$6B Binance theft to North Korea's TraderTraitor (FBI statement, Nov 1; via Decrypt).
• ~$2.85B of the $6.43B stolen has been frozen or seized — versus ~3% recovered after Bybit (Decrypt, Nov 2).
• As of Nov 2, >$1B in ETH and ~$1.42B in BTC had seen limited onward movement; other funds moving fast across chains (Chainalysis, via X).
• Funds laundered at ~one new wallet every 25 seconds across ~12,000 wallets (Decrypt, Nov 1).
• Binance: $4.72B net withdrawn since Sunday; total assets ~$157B (Binance spokesperson, via BBC).
• Binance says it has covered ~95% of stolen assets; wider reserves snapshot planned Wednesday (Binance, Oct 31 snapshot).

The real-world read Pyongyang's denial is routine — it has rejected past hacking accusations — and the "look who keeps the loot" deflection doesn't engage with the on-chain evidence that two independent firms and the FBI cite. On the other side, Binance's own numbers are the exchange talking about itself: the "95% covered," "$157B in assets," and "deposits now exceeding withdrawals" framing all come from Binance, with the asset total unverified by an outside party. Its zero-knowledge proof covers only the Oct. 31 snapshot of its ten largest tokens, not the full book. The seizure figure cuts against the panic — $2.85B frozen is roughly 44% of the haul, a far better result than Bybit's ~3% — but Chainalysis notes the laundering has barely started, and expects the sheer scale to strain Pyongyang's cash-out channels.

This is news coverage, not financial advice.

Sources

• Decrypt (Tier 2, Nov 3) — primary narrative; relayed the FBI attribution, KCNA/Yonhap statements from Kim Yo Jong, Chainalysis flow data, laundering pace, and Binance's recovery figures.
• FBI / Secret Service — attribution of the theft to TraderTraitor (via Decrypt).
• Chainalysis & TRM Labs — on-chain attribution and fund-movement tracking (Chainalysis posted directly on X).
• Binance — recovery claims and asset figures (self-reported, via company tweets and a spokesperson to the BBC; treat as interested-party statements).
• KCNA / Yonhap — North Korea's official denial.