North Korea denies the $6 billion Binance theft as the FBI and on-chain analysts point to TraderTraitor

North Korea has denied the FBI's finding that its hackers stole more than $6 billion in cryptocurrency from Binance on October 29. Blockchain analysts call it the largest single theft on record. Kim Yo Jong, the sister of leader Kim Jong Un and a senior official in the ruling party, called the accusation "a grave political provocation against the DPRK" and "absurd rhetoric and nothing new." Her statement was carried by the state news agency KCNA on Tuesday, per Asharq Al-Awsat and CoinDesk.

The denial lands against a growing body of evidence from the U.S. government, three independent blockchain-analytics firms and Binance itself. It also fits a familiar pattern. Pyongyang has rejected every previous attribution of a major crypto theft, including the $1.46 billion Bybit raid in February 2025. This story sets out what the FBI said and what the on-chain investigators found. It covers what Binance has disclosed about the breach, what North Korea says in reply, and what no one can yet show.

What the FBI said

On October 31, two days after the theft, the FBI published an alert naming North Korea. In a post from its Cyber Branch account on X, the bureau wrote that it "is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026." It added that it "refers to this specific North Korean malicious cyber activity as 'TraderTraitor,'" per the FBI Cyber Branch post as indexed by a search engine. The live post and the FBI alert page would not open for our tools.

The alert was issued with the U.S. Secret Service and IRS Criminal Investigation. It said investigators had "observed TraderTraitor actors converting stolen assets primarily into Ethereum." It expected the funds to be "further laundered by converting them using DeFi and instant swap services." It published a list of wallet addresses and asked exchanges and other crypto businesses to block transactions involving them, per The Hacker News and CoinDesk. The bureau has not released its forensic findings.

TraderTraitor is the FBI's name for a North Korea-aligned group that security firms also track as Jade Sleet, UNC4899 and Slow Pisces. The bureau blamed the same group for the Bybit theft, per CoinDesk. The FBI is led by Kash Patel; we found no statement from him personally on the Binance case.

President Trump, asked about the theft at his Florida residence on Saturday before the FBI alert was widely reported, said: "I'm not concerned. We're learning about it. We don't know if it's North Korea," per Asharq Al-Awsat. We found no later comment from the president reconciling that remark with the bureau's finding.

How the theft unfolded

Binance's own account was reported by Fox Business on Tuesday. The attack began with a fake job interview used to compromise an employee's computer, which Binance earlier described as a DevOps engineer's laptop. That machine gave access to an internal service container, from which unauthorized withdrawal requests were submitted. The attackers used Binance's internal AI tool to help execute the transactions. Binance says it has found no evidence that wallet private keys were compromised, per Fox Business. An earlier Binance update referred to "additional points of breach" without naming them, per Elliptic.

The on-chain record, reconstructed by Elliptic, TRM Labs and Chainalysis, shows preparation at least a day in advance. The attacker's wallet received three small withdrawals from the Tornado Cash mixer on October 28 and 29. A "sweeper" contract was deployed at 15:59 UTC on October 29 and rehearsed about four hours before use. At 20:20 UTC, a single Ethereum transaction carried 50 pre-signed authorizations that handed control of a Binance hot wallet to that contract. At 20:24, $2.53 billion left in one transfer. Funds then moved off Bitcoin, Tron, the XRP Ledger, Solana, NEAR, Base, Optimism, Arbitrum, Avalanche and Polygon over about three hours, per Elliptic and a Stingrai summary of TRM's timeline.

1. 2026-10-28Attacker wallet funded with small Tornado Cash withdrawals
2. 2026-10-2915:59 sweeper contract deployed; 20:20 Binance wallet delegated; 20:24 $2.53 billion moves
3. 2026-10-2921:01 Tether freezes a wallet holding 1.18 billion USDT; 21:04 Circle freezes 823 million USDC
4. 2026-10-3000:13 Binance suspends withdrawals and says it will cover all losses
5. 2026-10-31FBI attributes the theft to TraderTraitor
6. 2026-11-01Binance begins reopening withdrawals, starting with Bitcoin
7. 2026-11-03KCNA carries Kim Yo Jong's denial

Source: Elliptic, Stingrai

Estimates of the total differ by a few percent depending on the price used and which transfers are counted. Binance put the impact at about $6.3 billion. Elliptic counted $6.43 billion across 11 blockchains. It excluded a further $169 million moved after withdrawals were suspended, which it attributes to Binance's own funds. Chainalysis's first estimate was about $5.9 billion, per Elliptic and Stingrai. Four assets made up 74 percent of the haul: Tether and USD Coin on Ethereum, Bitcoin and Tether on Tron.

Source: Elliptic, figures as of its November 1 update, with theft values at the time of the theft and later values at current prices.

What was frozen and what was not

Stablecoin issuers can freeze tokens; no one can freeze bitcoin or ether. That distinction shaped the recovery. Tether froze a wallet holding 1.18 billion USDT 37 minutes after the funds arrived, and later froze four more addresses. Circle froze 823 million USDC about three minutes after Tether's first action. Ripple, World Liberty Financial, Paxos and First Digital froze their own tokens. The Arbitrum and Optimism networks used chain governance to secure everything stolen on them. Elliptic verified $2.85 billion frozen or seized, 44 percent of the theft, 94 percent of it in stablecoins. Binance's own estimate is about $3 billion, per Elliptic.

About $3.25 billion remained beyond reach across more than 800 addresses as of November 1, including roughly 584,000 ETH, 18,327 BTC and the 233 million XRP. Before the freezes landed, the attackers converted about $786 million of stablecoins into ETH and TRX. They sold 434 million USDT for 160,451 ETH through decentralized exchanges at an implied loss of 12 to 26 percent, a price they were evidently willing to pay for speed, per Elliptic.

Binance, Oct. 2026

$6,430

Bybit, Feb. 2025

$1,460

Ronin/Axie Infinity, 2022

$620

Bitget, Sept. 2026

$352

Source: Elliptic, CoinDesk, Wikipedia on Lazarus Group

Show the numbers

Theft	Millions
Binance, Oct. 2026	$6,430
Bybit, Feb. 2025	$1,460
Ronin/Axie Infinity, 2022	$620
Bitget, Sept. 2026	$352

Elliptic says the Binance theft "almost doubles the total cryptoassets stolen by the regime," which it had put at more than $6.5 billion over recent years, including more than $1 billion in 2026 before this incident, per The Hacker News. Those are the firm's estimates, not audited totals.

The case for attribution, and its limits

Three analytics firms reached the same conclusion before the FBI did. TRM Labs attributed the theft to TraderTraitor "with high confidence." Chainalysis cited "a high degree of confidence that DPRK is responsible." Elliptic set out four reasons. First, the stolen funds were laundered together with proceeds of the September Bitget exploit, a link first reported by the independent investigator ZachXBT. Second, the wallets used the same services as earlier TraderTraitor thefts from BigONE, WOO X and AFX. Third, the method resembled Bybit, with long preparation, targeting of staff and use of the exchange's own signing systems. Fourth, few actors could coordinate withdrawals across 11 blockchains in three hours, per Elliptic. Elliptic also found signs of automation in the laundering, including 1,113 Tron transfers with a median gap of 90 seconds and amounts randomized to six decimal places. It said the on-chain data cannot show whether AI agents were involved.

The limits are real too, and Elliptic lists them. Binance has not published a root cause. Its first explanation, the laptop, was followed by the unspecified "additional points of breach." The exchange initially found no private-key leak, while the on-chain data suggest its signing infrastructure was manipulated. The FBI's attribution "confirms but does not change" Elliptic's assessment, and the Bitget link came from a third party, per Elliptic.

A sharper caution came from Vasily Vidmanov, chief operating officer of the compliance firm AMLBot: "Onchain analysis can link wallets to one actor. It can't prove nationality or state sponsorship." If the funds follow the laundering route of earlier North Korea-attributed thefts, he said, that would answer the denial better than any statement, per CoinDesk. That is the gap the FBI's unpublished forensics would need to close. Linking a cluster of wallets to a known group is on-chain work. Linking that group to a government relies on intelligence the bureau has not shown.

Attribution disputes of this kind are not unique to crypto. Our report on the second wave of refrigeration cyberattacks on European supermarkets found governments split on who was behind them. The German warning about spyware on Bundestag iPhones turned on similar questions of what public evidence can show.

What North Korea says

Kim Yo Jong's statement, dated Monday and published by KCNA on Tuesday, called the FBI finding "a trite provocation of linking it with the Democratic People's Republic of Korea again." She said it was "a grave political provocation against the DPRK that the US misleads international public opinion" by acting "as if all the cybercrimes in different parts of the world are our deeds." She said "it is the consistent policy stand of the DPRK government to resolutely oppose all sorts of malicious acts in cyberspace." She added: "We have issues to reconsider in diverse aspects as regards the very unpleasant US hostile attitude," per Asharq Al-Awsat and CoinDesk. We could not open KCNA directly and rely on those outlets' transcriptions.

The statement offered no evidence and did not address the specific wallets, services or methods described by investigators. That is consistent with Pyongyang's past responses. Kim also disputed the Bybit attribution in 2025, and in May 2026 North Korea called U.S. cyber-threat accusations "absurd slander" and warned of countermeasures, per CoinDesk and BeInCrypto. The longer record includes the U.S. Treasury's 2019 sanctions on the Lazarus Group, Bluenoroff and Andariel, which it said were controlled by North Korea's military intelligence agency. It also includes a 2021 Justice Department indictment of three North Korean military hackers for attempting to steal or extort more than $1.3 billion, per CoinDesk. Sanctions and indictments are government findings and charges, not court verdicts; none of the indicted individuals has been tried.

What Binance has promised its users

Binance suspended deposits and withdrawals at 00:13 UTC on October 30 and said it would cover all losses. Its co-founder Yi He said deposits were unaffected and withdrawals would resume within 48 hours. They began reopening on November 1, starting with Bitcoin, and Binance later said all 15 networks were back. In the first nine and a half hours, users withdrew $4.65 billion and deposited $1.01 billion, a net outflow of about $3.64 billion, per The Hacker News and Stingrai.

On Tuesday the exchange said that "users will not bear the financial impact of this incident." It said it had replenished about 90 percent of the stolen assets, roughly $6 billion, from its Secure Asset Fund for Users and company funds. It said bitcoin, ether, tether and BNB balances remain fully backed. Co-CEO Richard Teng told Fox Business that customers will not bear losses. The company said it would invest more in AI-powered threat detection, set up a security research fund and work with leading AI companies, per Fox Business. Binance says it has more than 335 million users and average daily trading volume of $95 billion, per Asharq Al-Awsat. We could not open Binance's own incident recap on its blog. The figures above are as reported by the outlets named.

Those commitments are the company's statements. No independent audit of the replenishment had been published on any page we could open. Binance has not said how much of the $6 billion came from the SAFU fund, which it has previously described as about $1 billion, versus corporate funds.

What people were saying online

We set out to sample reactions on X and in r/worldnews, r/geopolitics, r/CryptoCurrency and r/politics between 1 a.m. and 2 a.m. Eastern on November 4. Reddit's listings, including the JSON feeds, were blocked to our tools. X's explore pages refused automated access, so we could read neither platform's rankings. Our permalink-verification tool failed on every X link we tried. What follows is drawn from search-engine indexing of X posts, which shows text but not live engagement counts. We quote only institutional and news accounts whose identity is not in doubt.

The FBI Cyber Branch's own post was the most-indexed item on the attribution. Financial-news accounts relayed it within the hour. The Kobeissi Letter called it "the largest hack in history" and noted the earlier Bybit attribution, per its post. Watcher.Guru posted "FBI confirms North Korea is responsible for the $6,300,000,000 Binance crypto hack," per its post. The Argentine outlet Corta, writing in Spanish, framed Kim's reply as calling the accusation "another violation of the sovereignty" of her country, per its post. We found no indexed posts from accounts credibly self-identified as inside North Korea, which has no public internet access for ordinary citizens. We found no representative survey of opinion in any country on the attribution. This section describes selected online reactions, not what the public thinks.

What remains unknown

The root cause. Binance has described a laptop, a service container, an internal AI tool and unspecified additional breach points, but not published a full account.

The FBI's evidence. The bureau has published wallet addresses, not the forensic basis for naming a state.

Where the unfrozen $3.25 billion goes. Elliptic expects layering through wallets, bridges, mixers and over-the-counter brokers; as of November 1 the XRP, SOL and NEAR holdings had not moved.

Any U.S. government response beyond the alert. We found no new sanctions designation, indictment or statement from Treasury Secretary Scott Bessent tied to this theft on any page we could open.

Sources and method

Reported between 1 a.m. and 2 a.m. Eastern on November 4, 2026. Pages we opened: Elliptic's analysis (updated November 1), The Hacker News, CoinDesk, Asharq Al-Awsat, Fox Business, the Stingrai summary of TRM Labs and Chainalysis data, BeInCrypto and Wikipedia's Lazarus Group entry. The FBI alert page, Binance's blog, The Hill, NBC News, SecurityWeek, The Japan Times and CNBC were blocked to our fetch tool. Where we cite the FBI's wording we name the outlet that carried it. Reddit and X could not be opened or verified; posts above are quoted as indexed by a search engine. Our standards for sourcing and corrections are on our methodology page.

Differing perspectives

Does the available evidence establish that North Korea's government was behind the Binance theft?

Each position is summarized as its supporters make it, with equal weight and in alphabetical order. A summary is not an endorsement; the evidence for each is weighed in the story above.

• North Korea was responsible and its wallets should be blocked

  Who holds it: The FBI, with the U.S. Secret Service and IRS Criminal Investigation

  The bureau says North Korea was responsible for the theft of more than $6 billion from Binance on or about October 29, and that the activity belongs to the group it tracks as TraderTraitor, the same actor it named in the Bybit theft. It says investigators have watched the actors convert stolen assets mainly into Ethereum and expect further laundering through DeFi and instant-swap services. On this view, the pattern of preparation, intrusion and laundering matches years of documented North Korean operations, and the practical response is for exchanges, bridges and other crypto businesses to block the listed addresses now rather than wait for a court record.

  In their words: FBI public alert, October 31, 2026 ↗

• The accusation is a political provocation without evidence

  Who holds it: The North Korean government, through Kim Yo Jong's statement carried by KCNA

  Pyongyang says the United States blames it for cybercrimes around the world as a matter of habit, calling the FBI finding a "trite provocation" and "absurd rhetoric and nothing new," in the statement's own words. It argues that Washington misleads international opinion as if every cybercrime were a North Korean act, and that the DPRK government's consistent policy is to oppose all malicious acts in cyberspace. On this view, the accusation is a grave political provocation designed to damage the country's image, no evidence has been presented, and the hostile attitude behind it is something North Korea will have to reconsider in its own dealings with the United States.

  In their words: Kim Yo Jong statement via KCNA, as carried by Asharq Al-Awsat ↗

• The on-chain evidence supports the attribution, with stated limits

  Who holds it: Blockchain analytics firms Elliptic, TRM Labs and Chainalysis

  The analysts argue that the public blockchain record is enough to attribute the theft to the North Korea-linked TraderTraitor cluster with high confidence. They point to the stolen funds being laundered together with proceeds of the September Bitget exploit, the use of the same services as earlier TraderTraitor thefts, a method that mirrors Bybit, and a scale of coordination across 11 chains that few actors could manage. They also set out what the data cannot show: Binance has not published a root cause, the first explanation was later supplemented, and on-chain data cannot reveal whether AI agents were involved. On this view, the FBI's alert confirms but does not change what the chain already showed.

  In their words: Elliptic, analysis updated November 1, 2026 ↗

• Wallet clustering cannot prove nationality or state sponsorship

  Who holds it: Compliance analysts including Vasily Vidmanov of AMLBot

  This view accepts that on-chain analysis can tie many wallets to a single actor but argues that it cannot by itself prove that actor's nationality or that a government directed it. Attribution to a state rests on intelligence that investigators have not published, and the public should keep that gap in mind when a denial is weighed against an alert. The test, on this view, is behavioral: if the remaining funds follow the laundering route seen in earlier North Korea-attributed thefts, that movement will answer the denial better than any statement from either government, and until then the state-level claim should be read as a strong inference rather than a demonstrated fact.

  In their words: CoinDesk, quoting AMLBot's Vasily Vidmanov, November 3, 2026 ↗