North Korea Denies Binance Hack as Seoul Tightens Security

Kim Yo Jong rejects FBI attribution

Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a senior ruling party official, rejected the FBI finding in a statement carried by the Korean Central News Agency. She called the attribution “an absurd rhetoric and nothing new” and “a grave political provocation against the DPRK,” while accusing Washington of trying to portray North Korea as a “cyber criminal state.”

Kim also suggested investigators should consider who would ultimately receive confiscated assets after their recovery. She referred to “who will get the large amount of the so-called stolen cryptocurrency,” while separately saying that looking at who ends up with the assets “may get a clue about who is behind the hacking incident.” Her remarks pointed to the Trump administration’s plan to use confiscated cryptocurrency as part of a strategic reserve.

Pyongyang also repeated its rejection of an earlier U.S. attribution involving the $1.5 billion Bybit hack in February 2025. Kim said the U.S. “has attempted to spread misunderstanding of the DPRK” and warned that North Korea had “issues to reconsider” because of what she called a “very unpleasant US hostile attitude.”

The FBI attributed the Binance theft to TraderTraitor on Oct. 31. The agency has also blamed the same North Korea-linked group for the Bybit breach. The U.S. Secret Service and blockchain analytics firms have likewise connected the Binance attack to TraderTraitor.

TRM Labs said it made the attribution “with high confidence,” citing attacker wallets funded through Tornado Cash and transaction signatures obtained in advance and executed together, techniques it linked to earlier North Korean operations.

Chainalysis traced more than $500 million through intermediary Tron wallets before another laundering phase moved to Solana. Blockchain investigator ZachXBT found Binance and Bitget funds converging at the same address after moving through THORChain, while Bitget CEO Gracy Chen said early findings linked IP addresses to VPN services used “by a certain DPRK group.”

No court has ruled on the attribution, and the firms cited in the reporting had not published their underlying off-chain evidence. That leaves a clear distinction between the FBI and blockchain firms’ attribution and North Korea’s categorical denial.

Billions remain in wallets linked to the attackers

Blockchain tracking shows that a substantial share of the stolen cryptocurrency remains either frozen or inside wallets linked to the attackers. Different analytics firms produced slightly different overall estimates: TRM Labs traced about $6.36 billion leaving Binance on the day of the attack, while Elliptic’s later estimate put the theft at $6.43 billion.

The movement has involved about 12,000 wallets across 11 blockchains during the first four days, equivalent to roughly one new wallet every 25 seconds. That pace differed from the Bybit case, where all of the stolen ether was moved within 10 days. Chainalysis said the activity broadly resembled the “immediate layering” phase seen in previous North Korean attacks and that repeated returns to earlier addresses across thousands of transactions suggested automation.

Chainalysis said the size of the theft could “strain the actors' trusted laundering channels,” potentially pushing more activity toward bridges, instant exchanges and swapping services. Elliptic expects remaining assets to be converted into Bitcoin over coming months and moved through over-the-counter brokers and exchanges.

Binance restores services and rebuilds reserves

Binance’s operational recovery continued as the attribution dispute unfolded. The exchange said net withdrawals since services resumed reached $4.72 billion, which a company spokesperson called a “relatively limited portion” of approximately $157 billion in total assets. By 10 p.m. ET on Monday, hourly deposits had moved above withdrawals, which Binance said reflected “improving user activity and stabilizing flows.”

The exchange subsequently restored withdrawals for dozens of additional tokens on Ethereum and Solana. Binance also introduced balance verification for holders of its 10 largest tokens, including BTC, ETH, USDT and USDC, using a zero-knowledge proof based on its Oct. 31 reserves snapshot.

Binance said it had covered about 95% of the stolen assets. The remaining portion consisted of less-liquid tokens that required more time to acquire, while the exchange planned a wider reserves snapshot on Wednesday.