North Korea Rejects FBI Allegations Over Binance Hack
North Korea has denied responsibility for the October 29 Binance hack, which resulted in the theft of approximately $6.4 billion in cryptocurrency. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, described the U.S. accusations as a political provocation and rejected claims that a North Korean-linked hacking operation carried out the attack.
In a statement published by North Korea’s state-run Korean Central News Agency (KCNA), Kim accused Washington of repeatedly associating her country with major cybercrimes. She also criticized the FBI for attempting to portray North Korea as a “cyber criminal state.”
“As regards this extra-large incident, the U.S. has made a trite provocation of linking it with the Democratic People's Republic of Korea again,” Kim said. She described the allegations as “absurd rhetoric and nothing new.” The full statement is available through the KCNA official publication.
FBI Attributes the October 29 Theft to TraderTraitor
Kim’s denial followed an October 31 announcement from the U.S. Federal Bureau of Investigation. The FBI attributed the Binance theft to TraderTraitor, an operation it identifies as North Korean-linked malicious cyber activity.
The agency said the theft involved more than $6 billion in virtual assets taken from Binance on or around October 29, 2026. It also identified cryptocurrency wallet addresses that it said were operated by or closely connected to TraderTraitor actors. The FBI, working with the U.S. Secret Service and the IRS Criminal Investigation division, urged cryptocurrency exchanges, decentralized finance services, blockchain infrastructure operators and other virtual asset providers to block transactions involving the identified addresses.
The FBI said investigators had observed the stolen assets being converted primarily into Ethereum (ETH). It warned that the funds could subsequently move through decentralized finance platforms and instant-swap services as part of further laundering activity. The agency's official cyber alert contains the attribution and the wallet addresses identified by investigators.
Blockchain Investigators Trace the Stolen Cryptocurrency
Blockchain analytics firms have also linked the Binance incident to TraderTraitor. Chainalysis attributed the approximately $6.4 billion theft to the North Korean-linked operation, citing on-chain connections between the stolen Binance assets and funds associated with an earlier Bitget theft.
Its investigation described a laundering process involving numerous transactions and wallet addresses. The analysis also identified signs of automated activity, including repeated transaction patterns. However, evidence of automation does not establish that artificial intelligence systems controlled the laundering process.
The distinction between blockchain evidence and attribution is important. On-chain records can show how funds move between addresses and reveal connections between transactions, but wallet activity alone does not independently establish the nationality or government sponsorship of an attacker. The FBI's conclusion is its official attribution, while investigators' blockchain analysis provides additional evidence used to trace the funds. Chainalysis has published its findings in its Binance exploit investigation.
North Korea Challenges Previous Cyberattack Allegations
Kim Yo Jong also challenged the U.S. attribution of the $1.5 billion Bybit hack in February 2025, which the FBI previously linked to TraderTraitor. She argued that Washington repeatedly associates North Korea with cybercrime around the world.
“It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cybercrimes in different parts of the world are our deeds,” she said.
The United States has taken several enforcement actions against North Korean-linked hacking groups over the years. In 2019, the U.S. Treasury Department sanctioned Lazarus Group, Bluenorff and Andariel, identifying them as groups controlled by North Korea's military intelligence agency. The Treasury Department's announcement outlined the sanctions and the government's assessment of their activities.
In 2021, the U.S. Department of Justice charged three North Korean military hackers with participating in a broad scheme involving attempted theft and extortion of more than $1.3 billion from banks and businesses, including cryptocurrency companies. The Justice Department announcement detailed the charges.
The Treasury Department also sanctioned cryptocurrency mixer Sinbad in 2023, describing it as a money-laundering tool used by Lazarus Group. The action connected the service to laundering proceeds from the $620 million Axie Infinity theft and other cyberattacks. These historical actions provide context for U.S. allegations, but they do not independently prove responsibility for the 2026 Binance incident.
Investigation Leaves Questions About Attribution and Laundering
The FBI has not publicly released its complete forensic findings on the Binance attack. Its October 31 alert identifies wallet addresses associated with the stolen assets and states that they are controlled by or connected to TraderTraitor actors. The agency has called on cryptocurrency businesses and blockchain services to prevent those funds from moving through their platforms.
Vasily Vidmanov, COO and head of investigations at AMLBot, said that blockchain analysis can connect wallets to an actor but cannot independently prove nationality or state sponsorship. He described the North Korea attribution as based on cumulative evidence rather than a single on-chain finding.
Vidmanov also pointed to connections between funds stolen from Binance and Bitget that investigators say converge in common wallets. He argued that the subsequent movement of the assets through familiar laundering routes could provide further evidence relevant to the attribution. In particular, he highlighted potential conversions into Bitcoin and transfers through over-the-counter brokers.
What Happens Next for Binance and the Investigation?
The next stage of the investigation will focus on tracing the stolen assets, identifying services used to move them and preventing additional laundering. The FBI's request for exchanges, DeFi platforms and infrastructure providers to block transactions involving the listed addresses is part of that effort.
North Korea's denial does not resolve the competing claims. The FBI has formally attributed the attack to TraderTraitor, while Kim Yo Jong has rejected the accusation. The agency's full forensic evidence has not been made public, leaving outside observers without access to every detail behind the attribution.
For the cryptocurrency industry, the incident highlights the importance of monitoring stolen funds across multiple blockchains and coordinating responses among exchanges, analytics firms and infrastructure providers. The investigation's findings, along with any additional disclosures from law enforcement, will help clarify how the attackers moved the assets and whether more funds can be frozen or recovered.
