- Trending
- Comments
- Latest
Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied on Tuesday, November 3, 2026, that North Korea hacked Binance, branding the FBI’s attribution of the $6.3 billion theft a “trite provocation” in a statement carried by state media KCNA.
She offered no evidence pointing to another culprit, while the FBI maintains the North Korea-linked group TraderTraitor carried out the October 29, 2026 breach.
Kim Yo Jong has strongly challenged Washington’s allegations that North Korean hackers were responsible for the multibillion-dollar cryptocurrency theft.
According to a statement carried by KCNA and reported by South Korea’s Yonhap News Agency, Kim described the FBI’s conclusions as a “grave political provocation” against Pyongyang.
She accused American authorities of attempting to damage North Korea’s international reputation by linking the country to major cybercrime incidents.
“The FBI is trying to brand the DPRK as a ‘cyber criminal state’,” — Kim Yo Jong, in a statement carried by KCNA.
DPRK refers to the Democratic People’s Republic of Korea, North Korea’s official name.
Kim also characterized the allegations as “absurd rhetoric,” questioning the basis of the FBI’s attribution and criticizing Washington’s handling of the investigation.
Her remarks represent an unusually direct response from a senior North Korean political figure to allegations involving cryptocurrency theft.
The Binance hack has attracted international attention because of the scale of the stolen assets and the growing involvement of American law enforcement agencies in tracing their movement.
Kim further accused the United States of undermining North Korea’s sovereignty in cyberspace, suggesting that Washington was using the investigation to portray Pyongyang negatively.
She also questioned American intentions regarding the confiscation and eventual distribution of recovered cryptocurrency.
According to the report, Kim suggested that the ultimate recipients of recovered funds could provide insight into the circumstances surrounding the theft.
However, she did not present evidence identifying another individual, organization, or government as responsible for the attack.
Kim said North Korea was “closely monitoring” Washington’s actions and indicated that Pyongyang would reconsider aspects of its approach toward the United States.
The statement establishes a clear dispute between North Korea’s official position and the findings released by American investigators.
The FBI’s October 31 security alert directly attributed the October 29 theft to North Korea-linked cyber actors operating under the name TraderTraitor.
According to the agency, the attackers stole more than $6 billion in cryptocurrency from Binance, making the incident one of the largest reported digital asset thefts.
The attribution followed investigations conducted in cooperation with the U.S. Secret Service and the Internal Revenue Service’s Criminal Investigation division.
Federal investigators reported that the suspected attackers had begun converting stolen cryptocurrency primarily into Ethereum.
Authorities also warned that the assets could subsequently move through decentralized finance protocols and instant cryptocurrency exchange services.
These platforms enable digital assets to be exchanged across different networks, creating additional challenges for investigators attempting to identify and restrict suspicious transactions.
Following the Binance hack, the FBI published Ethereum wallet addresses believed to have received or previously held stolen cryptocurrency.
The agency identified the addresses as being operated by or closely connected to TraderTraitor actors.
It also urged cryptocurrency exchanges, decentralized finance platforms, blockchain operators, and analytics companies to restrict transactions involving the identified wallets.
The warning specifically included THORNode operators, RPC node operators, instant exchanges, and other virtual asset service providers.
Blockchain intelligence company TRM Labs separately expressed high confidence in its assessment connecting the theft to North Korean hackers.
However, North Korea’s denial means the attribution remains publicly contested, even as U.S. authorities continue treating TraderTraitor as responsible.
Binance’s preliminary investigation suggested that attackers may have compromised an engineer’s laptop, potentially gaining unauthorized access to the exchange’s internal infrastructure.
The company said it had found no evidence that wallet private keys were leaked during the incident.
These findings address the suspected technical entry point but do not, by themselves, establish the identity of the individuals behind the attack.
Blockchain analytics firm Elliptic released additional findings on November 2 detailing the extensive movement of cryptocurrency following the security breach.
The company estimated the total value of stolen assets at approximately $6.43 billion, slightly higher than the $6.3 billion figure widely reported by Binance and other industry sources.
According to Elliptic, the funds moved through approximately 12,000 cryptocurrency wallets and more than 40,000 transactions across 11 blockchain networks during the first four days.
The scale of the transfers suggests an extensive effort to redistribute the stolen assets across multiple addresses.
Elliptic reported that much of the initial activity occurred on Tron, where funds were distributed among approximately 7,700 wallet addresses.
The attackers subsequently used cross-chain bridges to move assets onto Ethereum, complicating efforts to follow individual transactions.
TheBinance hack also prompted substantial intervention from stablecoin issuers seeking to prevent stolen tokens from being transferred or exchanged.
Elliptic estimated that approximately $786 million in stolen stablecoins had been converted into other cryptocurrencies before issuers could freeze them.
Another $2.85 billion had reportedly been frozen or seized, representing approximately 44% of the firm’s estimated theft value.
Meanwhile, roughly $3.24 billion remained in addresses associated with the incident, primarily denominated in Bitcoin and Ethereum.
The analytics company indicated that only a negligible portion of the stolen assets appeared to have been converted into spendable funds.
Its investigation also identified approximately 28 Bitcoin, worth around $2.2 million at the time, moving through cryptocurrency mixing transactions.
Such transactions can make the relationship between sending and receiving addresses more difficult to establish.
Although blockchain analysis can identify transaction patterns and associated wallets, it does not always reveal the individuals controlling them.
Consequently, the findings provide insight into the movement of the assets without independently resolving the political dispute over the attackers’ identities.
As investigators continued tracing the stolen funds, Binance reported progress in restoring affected cryptocurrency balances and resuming customer services.
On November 2, the exchange completed a reserve verification covering ten major digital assets.
These included Bitcoin, Ethereum, BNB, Solana, USDT, USDC, XRP, USD1, RLUSD, and Zcash.
According to the exchange, approximately 95% of the affected assets had been replenished using company resources.
The remaining portion reportedly involved less-liquid cryptocurrencies that required additional recovery and replacement arrangements.
The Binance hack had initially forced the exchange to restrict cryptocurrency withdrawals while security teams assessed the affected infrastructure.
Binance began restoring withdrawals on November 1, initially reopening selected services involving Bitcoin and assets operating on Ethereum and BNB Smart Chain.
The exchange subsequently announced plans to resume additional withdrawals progressively from November 3, subject to further operational and security checks.
Binance has also committed to absorbing financial losses associated with the incident rather than passing them directly to affected customers.
The recovery measures come as investigators continue identifying wallets connected to the theft and monitoring attempts to move cryptocurrency through exchanges and decentralized platforms.
While the company has made progress in replenishing customer balances, the broader investigation remains ongoing.
The dispute between Washington and Pyongyang adds a geopolitical dimension to an incident already attracting scrutiny because of its financial scale and complex blockchain transactions.
For American investigators, the priority remains tracing stolen funds, disrupting suspected laundering operations, and identifying the individuals responsible.
For North Korea, the allegations represent another confrontation with Washington over accusations of state-linked cybercrime.
As both sides maintain opposing positions, the Binance hack remains the subject of an extensive international investigation involving law enforcement agencies, blockchain intelligence firms, and cryptocurrency service providers.
The eventual recovery of the remaining assets will depend on investigators’ ability to trace further transfers, secure cooperation from digital asset businesses, and prevent stolen cryptocurrency from being converted into funds beyond their reach.
Copyright © 2025 - The Bit Gazette.
