North Korea on Tuesday rejected the FBI's finding that its hackers stole more than $6B from Binance, in a statement from Kim Yo Jong carried by state news agency KCNA. The statement suggests the US itself could be behind the theft.
What Pyongyang said
Kim Yo Jong, sister of leader Kim Jong Un, said "it is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds," in a statement carried by KCNA. She called the accusation a "sinister" attempt to damage the country's international image.
Kim turned the blame back on Washington, pointing to the Trump administration's plan to use confiscated crypto as a strategic reserve. Anyone who looks at who ends up with "the so-called stolen cryptocurrency" once it is retrieved "may get a clue about who is behind the hacking incident," she said.
What the FBI found
- The FBI said Saturday that the North Korean group it calls TraderTraitor was responsible for the theft of more than $6B from Binance
- The attribution confirms findings published last week by blockchain analytics firms TRM Labs and Chainalysis
- The FBI attributed the $1.5B Bybit hack of February 2025 to the same group
- North Korea has denied previous hacking accusations
Where the funds are
As of November 2, more than $1B in ETH and roughly $1.42B in BTC stolen from Binance had seen limited onward movement, while other funds were moving rapidly across chains, according to Chainalysis. The funds are not all progressing through the laundering process at the same pace.
The activity is broadly consistent with the "immediate layering" phase seen after past North Korean hacks, but funds repeatedly returning to earlier addresses across thousands of transactions suggests automation, the firm said. Chainalysis expects the scale of the theft to "strain the actors' trusted laundering channels," pushing funds toward bridges, instant exchanges and swapping services.
Where Binance stands
Binance said net withdrawals reached $4.72B since they resumed on Sunday, a "relatively limited portion" of total assets of about $157B.
By 10 p.m. ET on Monday, hourly deposits were exceeding withdrawals, "reflecting improving user activity and stabilizing flows," Binance said. The exchange has since restored withdrawals for dozens more tokens on Ethereum and Solana.
- Holders of its 10 largest tokens, including BTC, ETH, USDT and USDC, can verify their balances are fully backed via a zero-knowledge proof of the October 31 reserves snapshot
- Binance has covered about 95% of the stolen assets; the rest is less liquid tokens that take longer to buy
- A wider reserves snapshot is planned for Wednesday