North Korea Denies Role in $6.3 Billion Binance Hack

November 4, 2026 MM Crypto Team

North Korea has denied any role in the 6.3 billion dollar theft from Binance, rejecting the FBI’s attribution of the attack to a North Korean-backed hacking group. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, issued the denial in a statement released through the state-run Korean Central News Agency on Tuesday, and appeared to suggest, without evidence, that the United States could have been behind the theft.

The statement is Pyongyang’s first formal response to an attribution that has hardened quickly since the October 29 hack. The FBI said on October 31 that the theft was carried out by TraderTraitor, a North Korean hacking operation, and urged cryptocurrency services to block transactions involving identified wallet addresses. Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence, and other investigators, including Chainalysis and independent researcher ZachXBT, have also linked the theft to North Korean hackers. Kim’s statement rejects that entire edifice in sweeping terms, while offering no evidence for its counter-claim.

“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” Kim said, using the initials of the country’s formal name, the Democratic People’s Republic of Korea. “But the US assertion is an absurd rhetoric and nothing new.” She described the allegations as a political provocation intended to damage North Korea’s international standing, and said the United States frequently and blindly links North Korea with large-scale cybercrime incidents to create misunderstandings about the country.

The counter-claim: follow the recovered money

Kim’s most striking passage turned the accusation around. “If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident,” she said. The implication, left deliberately vague, is that whoever ends up holding recovered funds is the party that benefits from the theft, and therefore a plausible suspect.

The statement provided no evidence connecting Washington to the attack, and Cointelegraph noted that it reached out to the FBI for comment. No United States official had responded to the counter-claim at the time of reporting. The logic of the argument is also weak on its face: recovered funds in a case like this would ordinarily be returned to victims, frozen by exchanges and stablecoin issuers, or held as evidence, not transferred to the government that attributed the attack. Binance has said users will not bear the cost of the theft, and roughly 3 billion dollars of the stolen assets have been reported frozen across various blockchains, with Tether freezing more than 1.567 billion USDT and Circle freezing more than 800 million USDC, according to TRM Labs. None of that frozen value has been shown to flow to the United States government.

How the attribution was built

The case against TraderTraitor rests on several independent strands, and understanding them is the only way to judge the denial fairly. TRM Labs, which attributed the attack with high confidence, pointed to similarities with previous North Korean operations, including advance preparation, the use of Tornado Cash to fund attacker wallets, and the coordinated execution of previously obtained transaction signatures. The attack itself showed unusual sophistication: according to Binance’s November 3 incident report, the intrusion began in June with a tampered software installation, ran through a fake job interview in September that delivered malware to an engineer’s device, and culminated on October 29 when attackers used stolen credentials to deploy a malicious container and exploit EIP-7702, an Ethereum feature that lets a wallet delegate some of its transaction powers to a contract, to drain hot wallets.

On-chain investigator ZachXBT identified a further connection between the Binance theft and an earlier hack of the Bitget exchange, saying stolen funds from both incidents were commingled at the same address after passing through THORChain, a cross-chain swapping protocol. During the early investigation, Bitget chief executive Gracy Chen said preliminary findings linked IP addresses to VPN services used by a certain North Korean group. Elliptic, another blockchain analytics firm, told CoinDesk that its investigation supports the FBI’s attribution specifically to TraderTraitor, stating that the on-chain evidence links the 6.4 billion dollar theft from Binance to North Korea. The firm also noted automated laundering activity, while finding no proof that artificial intelligence agents directed the transactions.

None of this evidence has been published in full. Intelligence agencies and private firms routinely withhold sources and methods, which means the public cannot independently verify every link in the chain. That is a legitimate limitation, and it is the space in which denials like Kim’s operate. But the attribution does not rest on a single claim from a single government. It rests on converging findings from the FBI, TRM Labs, Chainalysis, Elliptic and ZachXBT, using different data sources and methods, and pointing at the same actor. A denial that addresses none of those findings in detail is not, by itself, a rebuttal of them.

Why North Korea is accused so often, and why that cuts both ways

But frequency of accusation is not, on its own, evidence of error. North Korea’s cyber operations are among the best documented in the world, precisely because its hackers reuse infrastructure, laundering routes and social-engineering playbooks across operations, creating patterns that investigators learn to recognise. The Binance attack fits several of those patterns at once: the fake-recruiter approach used against engineers, the long preparation period, the use of Tornado Cash for initial funding, and the rapid, coordinated draining of wallets across ten blockchains. TRM Labs explicitly noted that the laundering activity after the Binance theft differed from the pattern that followed the Bybit hack, a detail that cuts against the idea of a lazy, copy-paste attribution and suggests investigators are distinguishing between operations rather than lumping them together.

What a denial can and cannot do

State denials of cyberattacks are routine, and they rarely change the technical consensus. North Korea denied the Bybit attribution, denied involvement in the 2014 Sony Pictures hack, and has denied a long list of other operations, while investigators’ findings in several of those cases have held up over time. A denial is a political statement, not a forensic one, and it carries no obligation to engage with wallet addresses, malware samples or transaction graphs. That does not make it meaningless: it signals how Pyongyang wants the episode framed internationally, and it puts other governments on notice that North Korea will treat further action, such as sanctions designations tied to the theft, as a political provocation rather than a law-enforcement matter.

For the cryptocurrency industry, the practical consequences of the attribution matter more than the diplomatic exchange. The FBI’s October 31 notice urged exchanges and services to block transactions involving identified wallet addresses, and the freeze figures show that much of the industry complied quickly. Stablecoin issuers can freeze tokens at the contract level, and several did so within hours. The remaining challenge is the portion of the funds that was converted into ether and other assets that cannot be frozen by an issuer, and that continues to move through mixers and cross-chain bridges. Attribution helps here in a concrete way: it gives compliance teams a basis for blocking addresses, and it gives law enforcement a framework for seeking seizures and arrests, even if the perpetrators themselves are beyond reach in North Korea.

Reading both claims with the right standard

The fair standard for readers is not to choose a side, but to weigh what each side has actually offered. The attribution side has offered named firms, specific techniques, transaction patterns and a consistent story across independent investigators, even if the underlying raw data is not fully public. The denial side has offered a rejection of the FBI’s motives, a complaint about a pattern of blame, and a suggestion about who benefits from recovered funds, without any technical evidence or alternative account of how the theft occurred. Those are not equivalent contributions to the factual record, and treating them as equal would be false balance.

What did Kim Yo Jong actually say?

Kim Yo Jong denied North Korea’s involvement in the Binance hack in a statement released through KCNA, calling the FBI’s attribution “absurd rhetoric” and a political provocation. She also rejected the FBI’s attribution of the February 2025 Bybit hack to North Korea, and suggested, without evidence, that the United States could have been behind the Binance theft.

Who attributed the hack to North Korea, and on what basis?

The FBI attributed the October 29 theft to TraderTraitor on October 31. TRM Labs attributed it to the same group with high confidence, citing on-chain and off-chain intelligence, including Tornado Cash funding of attacker wallets and coordinated use of previously obtained transaction signatures. Chainalysis, Elliptic and ZachXBT have also linked the theft to North Korean hackers.

Is there any evidence for the claim that the US was involved?

No evidence was provided in the statement or reported elsewhere at the time of writing. The claim rests on a suggestion that investigators should examine who benefits when stolen cryptocurrency is retrieved. Frozen funds have so far been reported as held by exchanges and stablecoin issuers, not transferred to the United States government.

Does the denial change the recovery or freezing effort?

No. The FBI’s notice urging services to block identified wallet addresses stands, and roughly 3 billion dollars of the stolen assets have been reported frozen. The denial is a political statement; it does not alter wallet addresses, transaction records or the compliance actions already taken.

Source: Cointelegraph

MM Crypto Analysis Web