North Korea Denies Role in $6.3B Binance Hack as FBI Attributes Attack to TraderTraitor
North Korea's Kim Yo Jong rejected FBI claims that Pyongyang-linked group TraderTraitor carried out the $6.3 billion Binance hack, calling the allegations political provocation. The denial comes as investigators trace stolen funds converted largely into Ethereum and warn of laundering through DeFi and instant swap services.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
North Korea's Denial
North Korea has denied involvement in the Binance hack, which blockchain intelligence firm TRM Labs estimated at approximately $6.36 billion in unauthorized withdrawals. Kim Yo Jong, sister of leader Kim Jong Un and a senior ruling party official, called the US allegations "absurd rhetoric" and a "grave political provocation," according to a statement carried by state news agency KCNA and reported by Reuters and Yonhap.
Kim accused Washington of trying to brand North Korea a "cyber criminal state" and of misleading international opinion by blaming Pyongyang for cybercrime worldwide. She presented no evidence identifying an alternative perpetrator, and said North Korea was "closely monitoring" US actions regarding recovery of stolen funds.
The FBI Attribution
The FBI's October 31 advisory attributed the October 29 breach to TraderTraitor, an operation it previously linked to North Korean cyber activity. Investigators, working with the US Secret Service, IRS Criminal Investigation and Justice Department officials, observed the attackers converting stolen assets primarily into Ethereum, with further laundering expected through decentralized finance platforms and instant swap services.
TRM Labs also attributed the attack to TraderTraitor with high confidence, citing blockchain transaction patterns and other intelligence. The FBI asked exchanges, blockchain operators and analytics firms to block transactions tied to identified wallet addresses.
Binance's Response and Open Questions
Binance has replenished approximately 95% of affected assets using company funds and has begun restoring withdrawals across multiple networks. The exchange also completed its latest Proof of Reserves verification for ten major assets, showing balances backed at least 1:1 as of October 31.
Binance's preliminary findings pointed to a compromised engineer's laptop that may have enabled unauthorized access to internal infrastructure, and the exchange said it found no evidence of leaked wallet private keys in its initial review. It has not publicly named the perpetrators. Elliptic has separately published findings on how the stolen assets moved across multiple networks, though the sources reviewed here do not give its full tally.
Why It Matters
For Traders
Binance withdrawal restoration and the flow of stolen funds into Ethereum and DeFi could affect liquidity and price action in the coming days.
For Investors
Attribution to a state-linked group and ongoing government asset recovery efforts signal rising sanctions and enforcement risk for centralized exchange custody.
For Builders
The reported compromise of an engineer's laptop highlights that internal access controls and endpoint security matter as much as wallet key management.
This article is for information only and is not financial advice. Read the full disclaimer.
