North Korea denies role in $6 billion Binance hack after FBI accusation

Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed US claims linking the country to the Binance hack as “absurd rhetoric,” Reuters reported on Nov. 2, citing the Korean Central News Agency, or KCNA. The denial disputes the US government's attribution of the theft of more than $6 billion from the cryptocurrency exchange.

The FBI had blamed North Korea's TraderTraitor operation in an Oct. 31 alert, placing the theft on or about Oct. 29. TraderTraitor is the bureau's name for the specific North Korean cyber activity it identified in the attack.

Blockchain intelligence firm TRM Labs estimated that approximately $6 billion left Binance wallets across ten blockchains, with most of the funds moving in about 20 minutes beginning at 20:05 UTC on Oct. 29. The firm's initial figures reflected observations through 00:30 UTC on Oct. 30.

TRM attributed the Binance hack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence.

The firm also assessed that valid signed transfers across different blockchains pointed to a compromise of Binance's hot-wallet signing infrastructure. That would place the breach in the systems used to authorize outgoing wallet transactions. The explanation remains TRM's assessment of how the transfers were enabled. Its conclusion connects the ability to produce valid transfers on different networks with a potential weakness in the infrastructure used to sign those transactions.

What the FBI observed and expected

The FBI said investigators had observed stolen assets being converted primarily into ether.

The blocking appeal covers listed addresses and funds moved onward from them.

The FBI attributed responsibility; North Korea disputed the attribution in a denial reported by Reuters citing KCNA. Blocking was requested, not confirmed as implemented. Expected laundering is a forecast in the October 31 alert.

Sources and evidence

Sources

1. Reuters via MarketScreener · 2 Nov 2026
2. FBI alert · 31 Oct 2026

Supporting facts

• Reported statement North Korea called claims linking it to the Binance heist a fabrication, Reuters reported on November 2, citing KCNA. [1]
• Reported statement The FBI said in an October 31 alert that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, identifying the activity as TraderTraitor. [2]
• Reported statement The FBI said investigators working with the US Secret Service and IRS Criminal Investigation had observed TraderTraitor actors converting stolen assets primarily into ether. [2]
• Reported statement The FBI expected further laundering through decentralized finance and instant-swap services. [2]
• Reported statement The FBI, US Secret Service and IRS Criminal Investigation urged blockchain infrastructure operators, exchanges, DeFi services and other virtual asset service providers to block transactions involving listed theft-linked addresses or funds derived from them. [2]

Method

Qualitative relationship diagram using retained Reuters and FBI reporting. Lines connect statements and requested action; they do not measure money or establish responsibility. The panel separates two stages in the FBI's October 31 alert.

Scope

The FBI attributed responsibility; North Korea disputed the attribution in a denial reported by Reuters citing KCNA. Blocking was requested, not confirmed as implemented. Expected laundering is a forecast in the October 31 alert.

Infographic by CryptoSlate

FBI seeks to block transactions linked to the Binance hack

The FBI said investigators working with the US Secret Service and IRS Criminal Investigation had observed the actors converting stolen assets primarily into ether. The bureau expected further laundering through decentralized finance, or DeFi, and instant-swap services.

The alert urged cryptocurrency service providers to block transactions involving the listed theft-linked addresses. It described those wallets as operated by, or closely connected to, TraderTraitor actors. CryptoSlate reported the FBI attribution and blocking appeal on Nov. 1, before the North Korean denial.

The request extends beyond exchanges to blockchain infrastructure operators, DeFi services and analytics firms. The FBI specifically named THORNode operators, RPC node operators and instant exchanges, alongside decentralized services and other businesses that handle virtual assets. It covers transactions involving both the identified addresses and funds derived from them.