North Korea Denies Binance Hack as Seoul Delays Sanctions Talks
North Korea rejected FBI attribution of the $6.3 billion Binance theft to its TraderTraitor operation, while South Korea has not begun talks on new sanctions tied to the breach. Seoul says it lacks a full picture of the October 29 incident, though its Foreign Ministry is reviewing broader cyber measures.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Attribution Remains Contested
The FBI on October 31 attributed the October 29 Binance hack to TraderTraitor, a North Korean operation previously linked to major crypto thefts. Pyongyang has rejected that finding. Kim Yo Jong, sister of leader Kim Jong Un, called the accusation a "grave political provocation" in a statement carried by KCNA, and said the country currently sees no reason to hold talks with Washington.
The attribution has also been supported by private analysis. TRM Labs linked the attack to TraderTraitor with high confidence, according to crypto.news. Binance itself has not independently named the attackers, and its investigation has so far described the intrusion method rather than the perpetrators.
How the Breach Happened
Binance's investigation found that attackers used a fraudulent recruitment process to install malware on an employee's computer in September. They then reached the exchange's wallet infrastructure through compromised internal systems and an AI tool, obtained a deployment permission token, and used stolen credentials to breach its internal wallet signing service.
Seoul Holds Off on Binance-Specific Sanctions
South Korea has not started discussions on additional sanctions tied to the Binance theft. A Unification Ministry official told Yonhap on November 5 that the government had not established the full circumstances of the incident, and that internal information-sharing would be needed before any response could be discussed. The comment concerns Binance-linked measures only and does not rule out other restrictions.
The Foreign Ministry, through spokesperson Park Doo-soon, said Seoul is reviewing several options against North Korean cyber activity, including unilateral cyber sanctions. It has made no decision and has not set a timetable or named targets.
Recovery and Fund Tracing
Binance said it had frozen or intercepted about $2.85 billion and replenished 98% of affected token assets by October 31. The FBI reported that the suspected attackers converted much of the stolen value into Ethereum before preparing to move it through DeFi services and exchanges, and US authorities asked infrastructure providers to block transactions tied to the addresses involved.
Figures to Note
The loss is reported as $6.3 billion in Crypto Briefing's coverage and as "more than $6 billion" in the FBI's alert as reported by crypto.news. Both sources describe the same event, and the difference reflects rounding rather than a dispute over the breach itself.
Why It Matters
For Traders
Ongoing fund movements and possible exchange freezes tied to the stolen assets could affect liquidity on venues and assets where the proceeds are being routed.
For Investors
A state-attributed theft of this size, with official denial and no finalized sanctions, leaves custody and security risk at major exchanges as an open question for the sector.
For Builders
The reported attack path through an employee machine, an AI tool, and a signing service argues for tighter controls on deployment tokens and internal signing infrastructure.
This article is for information only and is not financial advice. Read the full disclaimer.
