North Korea Calls Binance Hack Attribution a 'Grave Political Provocation'

North Korea has formally denied any role in the $6.3 billion Binance hack. Kim Yo Jong, sister of leader Kim Jong Un, called the FBI's attribution a "grave political provocation" in a statement carried by state-run Korean Central News Agency and reported by Yonhap on Tuesday.

"It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds," Kim said. She described the accusation as a "sinister" attempt to damage North Korea's international image.

She also flipped the accusation back at Washington. Kim pointed to the Trump administration's plan to hold confiscated crypto as a strategic reserve, suggesting that whoever ends up holding "the so-called stolen cryptocurrency" once it is recovered "may get a clue about who is behind the hacking incident."

Who does the FBI blame?

The FBI said on Saturday that a North Korean hacking unit it tracks as TraderTraitor stole more than $6 billion from Binance. That confirmed the attribution made a week earlier by blockchain analytics firms TRM Labs and Chainalysis. The same group, according to the FBI, carried out the $1.5 billion hack of crypto exchange Bybit in February 2025. Pyongyang has denied every prior hacking accusation.

The launderers are not sitting still. According to Decrypt, North Korea-linked wallets are cycling the haul through roughly one new wallet every 25 seconds, spread across about 12,000 addresses. About $2.85 billion of the $6.43 billion stolen has been frozen or seized so far — a recovery rate vastly better than the roughly 3% recouped after Bybit.

What does the laundering look like on-chain?

Chainalysis reported on Monday that the stolen funds are moving at very different speeds. More than $1 billion in ETH and about $1.42 billion in BTC had seen limited onward movement as of November 2. Other portions were moving rapidly across chains.

The pattern matches the "immediate layering" phase observed after past North Korean operations, the firm said. But funds repeatedly returning to earlier addresses across thousands of transactions point to automation rather than manual movement. Chainalysis expects the sheer scale of the theft to "strain the actors' trusted laundering channels," pushing the funds toward bridges, instant exchanges and swapping services instead.

Can Binance stabilize?

Binance declined to answer the BBC's questions about North Korea's alleged involvement. But the exchange offered hard numbers on its recovery. A spokesperson said net withdrawals since withdrawals resumed on Sunday reached $4.72 billion — which the company framed as a "relatively limited portion" of total assets of roughly $157 billion.

By 10 p.m. ET on Monday, the picture had shifted. Hourly deposits began exceeding withdrawals, "reflecting improving user activity and stabilizing flows," Binance tweeted. The exchange has since restored withdrawals for dozens of additional tokens on Ethereum and Solana.

The company has also moved to prove solvency. On Monday, Binance said users holding its 10 largest tokens — including BTC, ETH, USDT and USDC — can now verify their balances are fully backed through a zero-knowledge proof of its October 31 reserves snapshot. Binance says it has covered about 95% of the stolen assets so far, with the remainder held in less liquid tokens that take longer to repurchase. A wider snapshot is planned for Wednesday.

The denial from Pyongyang changes nothing operationally, but the fight over recovered assets is just beginning. With $2.85 billion already frozen and a fresh reserves snapshot due Wednesday, the next enforcement window centers on whether the remaining laundered funds can be traced before they reach the bridges and swap services Chainalysis expects the hackers to rely on.