North Korea Denies Binance Hack, Calls FBI Attribution 'a Trite Provocation'

Since the FBI's Oct. 31 advisory pinned the Oct. 29 Binance theft on North Korea's TraderTraitor unit, Pyongyang has now answered. Kim Yo Jong, the sister of leader Kim Jong Un and a senior ruling-party official, rejected the accusation in a statement carried by state news agency KCNA.

She called the FBI announcement "a trite provocation" and "an absurd rhetoric."

"This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the 'cyber crime' incidents whenever they occur on an international scale," she said. She added that North Korea is "closely monitoring a variety of persistent provocations of the U.S. against our state."

What the denial is up against

The FBI's attribution rests on what investigators say they observed: TraderTraitor converting stolen funds mainly into Ethereum. The bureau expects further laundering through decentralized finance platforms and instant swap services, and it published a list of addresses tied to the group.

Blockchain intelligence firm TRM Labs puts the haul at about $6.36 billion in unauthorized withdrawals from Binance hot wallets across ten blockchains. TRM attributes the attack to TraderTraitor "with high confidence," citing transaction patterns and other intelligence.

TraderTraitor is not a new name to the FBI. The bureau ties the same group to last year's $1.5 billion Bybit hack.

North Korea's record is also part of the picture. Pyongyang has mostly denied involvement in cyberattacks that outside analysts have linked to it, including the 2013 campaign against South Korean financial institutions, the 2014 Sony Pictures hack and the 2017 WannaCry attack. Outside experts say crypto theft helps the regime raise foreign currency and fund its nuclear program under sanctions. In December 2022, South Korea's spy agency estimated North Korean hackers had stolen about $1.1 billion in virtual assets over the prior five years.

Washington's own message is not uniform

The FBI is firm. President Trump, asked about the case at his Mar-a-Lago Halloween party, said: "I'm not concerned. We're learning about it," and suggested investigators were not yet certain North Korea was involved.

That is the president's public position next to a formal FBI advisory. The Secret Service, IRS Criminal Investigation and Justice Department officials are working the case alongside the FBI to identify and freeze stolen assets.

South Korea's Foreign Ministry said Monday that North Korea's illicit cyber activity is a growing threat to the global digital economy and that Seoul is working closely with the United States and others on it.

The denial also lands amid a run of North Korean weapons tests. The North said it tested a new cluster warhead for strategic cruise missiles. AP reports the tests appear aimed at gaining leverage for possible talks, after Trump said he wants to restore diplomacy with Kim Jong Un.

Binance's recovery

Binance says it has replenished roughly 95% of the affected assets from company funds. On Oct. 31, co-CEO Richard Teng put the figure at 90% and said the remaining 10% is in less liquid tokens that may take longer to buy back. The company says the money comes from its roughly $1 billion Secure Asset Fund for Users reserve, its Futures Insurance Fund and its corporate treasury. It has committed to refilling that reserve to about $1 billion.

Withdrawals are being restored across multiple networks. Binance had said it was on track to reopen withdrawals Nov. 1. It also completed a Proof of Reserves check on ten major assets, showing balances backed at least 1:1 as of Oct. 31.

Teng has described the breach as a "complex attack" involving an engineer's compromised laptop and malware built to delete evidence of its own activity. Binance has not publicly named the perpetrators and says it is still investigating how the attackers got into its infrastructure.

Recovery of the money is the open question. Ari Redbord, chief policy officer at TRM Labs, expects the hackers to split the assets into smaller pieces and push them through smaller exchanges, a process that could run for months. "It's bank robbery, in this case, at the speed of the Internet," he said, adding that investigators can trace funds in real time "to disrupt and to seize back funds."

The FBI has asked exchanges, blockchain analytics firms and other virtual asset service providers to block transactions linked to the listed TraderTraitor addresses. Whether that cuts off enough exits to freeze a meaningful share of the roughly $6.3 billion will show up in how much of the Ethereum can be moved and cashed out.