Trump Says 'We Don't Know If It's North Korea' on Same Day FBI Blamed Pyongyang for Binance Theft

Since the FBI pinned the Oct. 29 Binance theft on North Korea's TraderTraitor unit on Saturday, Oct. 31, the picture has gotten messier on the politics and clearer on the mechanics.

Trump and the FBI, same day

Speaking to reporters at Mar-a-Lago on Saturday, President Trump said the government has not settled the question. "We're learning about it. We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," he said.

The FBI's cyber alert that same day was flat. "The Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance," the bureau said. It said it worked with the Secret Service and IRS Criminal Investigation, and that it has observed the hackers converting stolen assets mainly into ether.

The two statements are not necessarily in conflict. The bureau described its findings as the result of a preliminary probe, and the president's remark leaves room for a diplomatic channel if attribution holds. But the head of the executive branch publicly saying he doesn't know, while an agency under him says it does, is a mixed message on a theft of this size.

CNN said it had asked North Korea's mission at the UN for comment, and Newsweek said it had reached out as well. Pyongyang has previously denied hacking allegations.

Binance itself is more cautious than the FBI. Co-CEO Richard Teng said the company's investigation has not attributed responsibility to any individual and has found no evidence of a wallet private key leak.

Binance says 90% is replaced

On Saturday Binance said it had replenished 90% of the stolen assets by using company money to buy new tokens. The remaining 10% is made up of less liquid tokens that may take longer to purchase.

"Our users will not bear the financial impact of this incident," Teng said on X. Binance had earlier said it would cover losses from company funds and an emergency assets fund, and that user funds are safe.

The company said deposits were unaffected, while withdrawals were suspended and expected to resume by Sunday morning.

The replacement money came from part of Binance's $1 billion Secure Asset Fund for Users, a bitcoin reserve held to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and the company's own corporate treasury.

CNN reported that a team of crypto firms froze about $3 billion of the loot. Bitcoin and other crypto prices fell Friday.

How fast it moved

Binance said an initial investigation points to an engineer's laptop, which let an attacker reach a service container and submit unauthorized withdrawal transactions. Teng said it was not a "one-click" action but a complex process, and that the attackers used a "self-destruct mechanism that destroyed tooling and traces."

TRM Labs says the hackers began preparing about 36 hours before the attack. Axios reported that roughly $6.3 billion left the exchange in about 20 minutes.

Eric Jardine, head of research at Chainalysis, said the transaction pace points to automation. "There were transactions happening with a frequency and a scale that just meant there could not have been someone involved in the approval of these," he said. "It had to have been done by a computer."

TRM Labs attributed the heist to a North Korean unit "based on robust on and off-chain intelligence." Chainalysis told CNN it has "high confidence" in the North Korea link, and Singapore-based Pangolin Intelligence reached the same conclusion from on-chain patterns matching earlier incidents.

The tactic is familiar. TraderTraitor operators are known to pose as recruiters and trick targets into running malicious code. In the 2024 theft of $308 million from Japan's DMM Bitcoin, the FBI said a hacker posing as a recruiter on LinkedIn sent an employee of a wallet software company a fake pre-employment test that compromised the system.

Seoul on alert

South Korean financial authorities have warned banks, securities firms and crypto exchanges after detecting about 4.4 million scanning attempts from North Korea-assigned IP addresses, starting at 3 a.m. on Oct. 21. No breach tied to those addresses has been confirmed. Officials said the activity looked aimed at finding open ports or vulnerabilities.

Singapore-based Cyfirma said on Oct. 22 that it had detected Korean-speaking operators discussing attacks using two critical PHP vulnerabilities. It named government agencies and financial institutions in South Korea, the U.S. and Japan as top targets, and pointed to possible links to the Lazarus Group ecosystem.

South Korean intelligence estimated in 2024 that Pyongyang's cyber force numbered around 8,400 personnel.

What comes next

The FBI says it expects "further laundering" through decentralized finance and instant-swap services. It has urged exchanges, blockchain analytics firms, DeFi services and node operators to block transactions tied to a list of wallet addresses it says North Korean actors control.

Binance has committed to covering the final 10% of the loss as those less liquid tokens become available to buy. Whether the White House's public position moves toward the FBI's remains open.