North Korea Denies FBI Attribution of $6.3 Billion Binance Hack

The competing claims

North Korea has denied responsibility for the roughly $6.3 billion Binance theft, rejecting the FBI's conclusion that North Korean actors carried out the attack. The denial adds a diplomatic dispute to an investigation into one of the largest reported crypto thefts on record.

In a statement carried by North Korean state media and reported by Yonhap, Kim Yo Jong called the U.S. attribution a political provocation. She also suggested the United States could be involved, pointing to its plans for a strategic crypto reserve. Her accusation is a claim, and the cited reporting does not establish evidence that the United States conducted the attack.

---

What the FBI said

The FBI attributed the theft of more than $6 billion in virtual assets from Binance around October 29 to North Korean cyber actors it calls TraderTraitor. The agency published addresses associated with the incident and asked industry participants to help prevent the assets from being laundered.

The FBI previously attributed the February 2025 Bybit theft, valued at approximately $1.5 billion, to the same group. Blockchain analytics firms TRM Labs and Chainalysis also linked the Binance attack to TraderTraitor, according to Decrypt. Those assessments and Pyongyang's denial remain opposing claims; the public reporting does not disclose every piece of investigative evidence.

---

Tracking and recovery

Decrypt reported that about $2.85 billion of an estimated $6.43 billion in stolen assets had been frozen or seized as of its reporting. The amount frozen or seized should not be confused with funds already returned to Binance or its customers. Estimates can change as investigators identify wallets and trace transfers.

Chainalysis said that, as of Monday, more than $1 billion in ETH and roughly $1.42 billion in BTC had seen limited onward movement while other assets moved more quickly across networks. The firm described activity consistent with an early laundering phase and said the scale could strain established channels, according to Decrypt.

---

Binance restores services

Binance has said it will cover customer losses. Decrypt reported that the exchange had replenished approximately 95% of affected assets, with less liquid tokens accounting for the remainder. The company also resumed withdrawals in phases, including additional tokens on Ethereum and Solana.

A Binance spokesperson told the BBC that net withdrawals reached $4.72 billion after withdrawals resumed Sunday, against approximately $157 billion in total assets. The exchange later said hourly deposits exceeded withdrawals by Monday night. These are company-reported figures from a particular point in the recovery, not a guarantee of future liquidity.

The immediate questions are how much of the stolen value can ultimately be recovered, how quickly remaining services normalize and what investigators disclose about the attack. Users can follow Binance's current withdrawal notices and reserve disclosures as the situation develops.