North Korea has denied involvement in the massive theft from Binance, the world’s largest cryptocurrency exchange. Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un and a senior ruling-party official, dismissed the U.S. allegation as “absurd rhetoric” and a “grave political provocation” in a statement carried by North Korean state media. She accused Washington of trying to brand North Korea a “cyber criminal state” and of repeatedly linking the country to international cybercrime. Kim also said Pyongyang had issues to reconsider in its dealings with the United States, but she did not specify what steps North Korea might take.
The Federal Bureau of Investigation said in a cybersecurity notice that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, on or about October 29, 2026. The FBI refers to the activity as TraderTraitor. It said investigators had observed the actors converting stolen assets primarily into Ether and expected further laundering through decentralized finance platforms and instant-swap services. The agency urged virtual-asset service providers, blockchain infrastructure operators and other companies to block transactions connected to addresses used by the suspected actors. The notice represents a formal attribution by a U.S. law-enforcement agency. North Korea rejects the accusation, however, and public reporting has not provided a complete body of independently verifiable evidence that establishes the operators’ national identity.
Coverage has used slightly different figures for the amount stolen. Binance-related reporting has described the loss as approximately $6.3 billion, while the FBI notice says more than $6 billion. The Associated Press described the incident as potentially the largest cryptocurrency-exchange theft on record and noted that North Korean hackers had also been blamed for a major attack on Bybit. Reporting by The Block and CoinDesk has examined how blockchain analytics firms traced the stolen funds and why investigators suspect links to North Korean actors. Those technical analyses form part of the attribution case, but the movement of cryptocurrency across wallets does not, by itself, establish the nationality of the people controlling them.
The Associated Press reported that President Donald Trump, when asked about the incident, said investigators were still learning about it and added, “We don’t know if it’s North Korea.” The comment contrasts with the FBI’s direct language attributing the theft to North Korea. The two statements are not identical in nature: the FBI published an agency notice describing its investigative conclusion, while Trump was responding briefly to reporters’ questions. His remark should not automatically be read as a formal reversal of the FBI’s assessment. It does, however, show that public statements from the U.S. government have not been entirely consistent in how they describe the level of certainty.
A separate development concerns Binance’s efforts to restore withdrawals across affected assets and blockchain networks. Reuters reported that co-CEO Richard Teng said withdrawals had normalized after an initial surge and that most affected tokens had been replenished. Deutsche Welle and cryptocurrency-focused outlets also reported on the phased restoration of withdrawals. The reopening of services does not mean all stolen funds have been recovered, nor does it settle the dispute over who carried out the attack. The exchange’s recovery effort, the FBI’s attribution, North Korea’s denial and the tracing of funds remain related but distinct parts of the story.
North Korea has routinely rejected allegations linking it to international cyberattacks, while U.S. authorities and cybersecurity researchers have attributed several major cryptocurrency thefts to North Korean-linked groups. The Associated Press cited outside experts who say illicit cyber activity is believed to provide North Korea with foreign currency and help support its economy and weapons programs. That broader context is relevant, but it cannot substitute for evidence specific to this incident. The next important questions are whether investigators release more verifiable technical details, whether additional stolen assets can be recovered or frozen, and whether cryptocurrency platforms and service providers take further action against the wallets identified in the investigation.