North Korea has denied US allegations that it was behind the $6.3 billion theft from cryptocurrency exchange Binance, with Kim Yo Jong, sister of leader Kim Jong Un, calling the FBI's accusation a 'grave political provocation' and 'absurd rhetoric' in a statement carried by state media on Tuesday.
In a statement published by the Korean Central News Agency, Kim Yo Jong said the US was trying to brand North Korea as a 'cyber criminal state' and misleading international public opinion by blaming it for cyber crimes worldwide. The FBI attributed the October 29 attack to TraderTraitor, a North Korean hacking unit linked to the Lazarus group. Cybersecurity experts said North Korean hackers were among the world's most prolific crypto thieves, with proceeds used to help fund weapons programs. Kim said North Korea had 'issues to reconsider' over what she called a 'very unpleasant US hostile attitude'.
Binance, the world's largest cryptocurrency exchange, discovered unauthorized withdrawals worth about $6.3 billion on October 29, saying the breach may have involved a compromised laptop used by a DevOps engineer. The company suspended withdrawals and said about $3 billion in assets had been frozen. It said it had recovered 90 percent of the stolen assets using company money, while it said it had replenished about 95 percent.
When Binance resumed withdrawals in phases on November 1, customers withdrew about $4.64 billion worth of assets and deposited $1.01 billion, resulting in a net outflow of approximately $3.64 billion, the company said. Binance said the outflows represented about 2.1 percent of its reported assets and called market conditions 'stable'.
The FBI said it had observed the hackers converting stolen assets primarily into Ethereum and expected them to launder the funds through decentralized finance platforms and instant swap services. The agency has published a list of wallet addresses linked to the theft. Blockchain intelligence firms TRM Labs and Elliptic had linked the theft to North Korea before the FBI weighed in, with TRM reporting that most of the $6.36 billion haul disappeared in about 20 minutes. Elliptic, which estimates the total closer to $6.43 billion, says it has verified that $2.85 billion has been frozen or seized.
Kim said the Trump administration had announced plans to confiscate illicit cryptocurrency for a strategic reserve, and suggested that who ultimately receives 'the so-called stolen cryptocurrency' could offer 'a clue about who is behind the hacking incident'.
The speed of Pyongyang's denial, analysts told Reuters, points to concern that Washington could step up efforts to cut off a funding source widely believed to bankroll arms development. North Korea has remained silent on President Donald Trump's offers to resume summit diplomacy, with experts saying Pyongyang may be weighing its options.
Analysis
Why This Matters
- The theft is the largest financial heist in history, dwarfing the roughly $1.5 billion Bybit raid in 2025 also attributed to North Korea.
- Binance has replenished most stolen funds but the trust of its users has been shaken, with billions in withdrawals after services resumed.
- The US accusation and North Korea's fiery denial come amid stalled diplomacy and could escalate tensions between Washington and Pyongyang.
Background
North Korean hacking groups have been responsible for a string of cryptocurrency thefts, with the proceeds widely believed to fund the country's weapons programs. The Lazarus group and its TraderTraitor unit have previously targeted crypto exchanges, including the $308 million attack on Japan's DMM Bitcoin exchange in 2024. The FBI has long warned about North Korea's use of cybercrime to evade international sanctions. This is not Binance's first hack: attackers made off with roughly $566 million in tokens from its BNB blockchain bridge in 2022.
Key Perspectives
North Korea (Kim Yo Jong, via KCNA): Accused the US of 'grave political provocation' and using cybercrime allegations to harm North Korea's global reputation; said Pyongyang had 'issues to reconsider' because of Washington's hostility and suggested that who receives the stolen cryptocurrency could reveal who is really behind the hack.
FBI: Attributes the heist to North Korean state-sponsored hacking unit TraderTraitor, says it has observed the stolen assets being converted to Ethereum and expects further laundering.
Binance: Says it has recovered or replaced about 90-95% of stolen assets out of company funds; reports stable market conditions despite $3.64 billion in net outflows after resuming withdrawals.
What to Watch
- Whether the FBI and international authorities succeed in freezing or recovering more of the stolen assets as the hackers attempt to launder them through DeFi platforms.
- Pyongyang's next move on Trump's offer to resume summit diplomacy; the speed of its denial suggests concern over the US cutting off a funding source.
- Binance's ability to restore user confidence; further outflows or a second wave of withdrawals could signal deeper trust issues.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe FBI blamed North Korean hackers for the record-breaking $6.3 billion theft from Binance.www.theregister.com - Articles: “The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance”
- SupportedIn an alert published Saturday, the FBI attributed the October 29 attack to TraderTraitor, linked to Lazarus Group.www.theregister.com - Articles: “In an alert published Saturday, the agency attributed the October 29 attack to TraderTraitor, a North Korean hacking operation linked to Lazarus”
- SupportedBinance says it has replenished about 95 percent of the stolen assets.www.theregister.com - Articles: “Binance has since resumed customer withdrawals, which it suspended after the attack, and says it has now replenished about 95 percent of the stolen assets.”
- SupportedTRM Labs linked the theft to North Korea and reported that most of the $6.36 billion haul disappeared in about 20 minutes.www.theregister.com - Articles: “Blockchain intelligence firms TRM Labs and Elliptic had linked the theft to North Korea, with TRM reporting that most of the $6.36 billion haul disappeared in about 20 minutes.”
- SupportedElliptic puts the theft total closer to $6.43 billion.www.theregister.com - Articles: “Elliptic, which puts the total closer to $6.43 billion”
- SupportedElliptic says it verified that $2.85 billion of the stolen assets have been frozen or seized.www.theregister.com - Articles: “says it has verified that $2.85 billion of the stolen assets have been frozen or seized.”
- SupportedThe FBI said the hackers had started swapping the stolen assets for Ethereum, and investigators expected them to use DeFi platforms and instant swap services to make the funds harder to trace.www.theregister.com - Articles: “According to the FBI, the hackers have started swapping their loot for Ethereum, with investigators expecting them to move the funds through decentralized finance (DeFi) platforms and instant swap services to make the money harder to trace.”
- SupportedThe FBI published wallet addresses linked to the theft and urged providers to block transactions involving the stolen funds.www.theregister.com - Articles: “The agency has published a list of cryptocurrency wallet addresses linked to the theft and is urging exchanges, blockchain analytics firms, and other virtual asset providers to block transactions involving the stolen funds.”
- SupportedBinance said a compromised DevOps engineer's laptop gave intruders access to a service container and allowed them to authorize withdrawals.www.theregister.com - Articles: “According to the exchange, the trouble started with a compromised DevOps engineer's laptop, which gave the intruders access to a service container and allowed them to authorize withdrawals they had no business making.”
- SupportedBinance committed billions of dollars from its reserves and emergency funds to cover the losses, and co-CEO Richard Teng promised customers would not be left footing the bill.www.theregister.com - Articles: “The exchange has committed billions of dollars from its own reserves and emergency funds to cover the losses, with co-CEO Richard Teng promising that customers won't be left footing the bill.”
- SupportedBinance recorded about $3.64 billion in net outflows after withdrawals resumed, which the company said was around 2.1 percent of its reported assets.www.theregister.com - Articles: “Binance recorded approximately $3.64 billion in net outflows after withdrawals resumed, although the company said this represented only around 2.1 percent of its reported assets.”
- SupportedBitget confirmed a $387.5 million wallet-draining cyberattack had hallmarks of a North Korean operation, and its CEO cited IP behavioral patterns and on-chain signatures.www.theregister.com - Articles: “crypto exchange Bitget has now confirmed that the cyberattack where hackers drained $387.5 million worth of digital assets from the exchange’s wallets also has all the hallmarks of a North Korean operation. Its CEO did not go into too much detail, but did say that “IP behavioral patterns and on-chain signatures” suggest it was Kim’s cronies at work.”
