{"version":"1.9","identifier":"e50fd688-4000-4d7f-8a24-d8a146c4165e","language":"en-US","title":"North Korea denies the $6 billion Binance theft as the FBI and on-chain analysts point to TraderTraitor","layout":{"columns":7,"width":1024,"margin":32,"gutter":20},"componentLayouts":{"text":{"columnStart":0,"columnSpan":7,"maximumContentWidth":720,"margin":{"top":12,"bottom":12}},"photo":{"columnStart":0,"columnSpan":7,"margin":{"top":20,"bottom":20}}},"componentTextStyles":{"default":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"textColor":"#171717"},"headline":{"fontName":"HelveticaNeue-Bold","fontSize":36,"lineHeight":42,"conditional":[{"conditions":{"maxViewportWidth":480},"fontSize":28,"lineHeight":34}]},"intro":{"fontName":"HelveticaNeue","fontSize":20,"lineHeight":28,"textColor":"#555555"},"caption":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":19,"textColor":"#666666"},"byline":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":20,"textColor":"#666666"},"body":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"paragraphSpacingAfter":14,"linkStyle":{"textColor":"#00704a"}}},"metadata":{"canonicalURL":"https://567politics.com/news/north-korea-denies-binance-6-billion-hack-fbi-tradertraitor-kim-yo-jong-november-2026","datePublished":"2026-11-04T06:44:54.55963Z","dateModified":"2026-11-04T06:47:13.025213Z","authors":["Patrick Karsh"],"excerpt":"Kim Yo Jong called the FBI's attribution \"a grave political provocation.\" Elliptic, TRM Labs and Chainalysis link the October 29 theft to North Korea; $2.85 billion is frozen and $3.25 billion is not. What the evidence shows, and what it cannot.","thumbnailURL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/e50fd688-4000-4d7f-8a24-d8a146c4165e/4283dd14b3a710c4d84f94867fb654e9.jpg","keywords":["world"],"generatorName":"Frog News","generatorVersion":"1.0"},"components":[{"role":"title","text":"North Korea denies the $6 billion Binance theft as the FBI and on-chain analysts point to TraderTraitor","textStyle":"headline","layout":"text"},{"role":"intro","text":"Kim Yo Jong called the FBI's attribution \"a grave political provocation.\" Elliptic, TRM Labs and Chainalysis link the October 29 theft to North Korea; $2.85 billion is frozen and $3.25 billion is not. What the evidence shows, and what it cannot.","textStyle":"intro","layout":"text"},{"role":"byline","text":"By Patrick Karsh · Published November 4, 2026","textStyle":"byline","layout":"text"},{"role":"photo","URL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/e50fd688-4000-4d7f-8a24-d8a146c4165e/4283dd14b3a710c4d84f94867fb654e9.jpg","caption":"The J. Edgar Hoover Building, FBI headquarters in Washington, D.C., photographed in August 2015. The FBI attributed the October 29, 2026 Binance theft to North Korea's TraderTraitor group. Photo: MattCC716, CC BY-SA 2.0, via Flickr. · MattCC716 via Flickr, CC BY-SA 2.0 (https://creativecommons.org/licenses/by-sa/2.0/)","accessibilityCaption":"The J. Edgar Hoover Building, FBI headquarters in Washington, D.C., photographed in August 2015. The FBI attributed the October 29, 2026 Binance theft to North Korea's TraderTraitor group. Photo: MattCC716, CC BY-SA 2.0, via Flickr.","layout":"photo"},{"role":"caption","text":"The J. Edgar Hoover Building, FBI headquarters in Washington, D.C., photographed in August 2015. The FBI attributed the October 29, 2026 Binance theft to North Korea's TraderTraitor group. Photo: MattCC716, CC BY-SA 2.0, via Flickr. · MattCC716 via Flickr, CC BY-SA 2.0 (https://creativecommons.org/licenses/by-sa/2.0/)","textStyle":"caption","layout":"text"},{"role":"body","format":"markdown","text":"North Korea has denied the FBI's finding that its hackers stole more than $6 billion in cryptocurrency from Binance on October 29. Blockchain analysts call it the largest single theft on record. Kim Yo Jong, the sister of leader Kim Jong Un and a senior official in the ruling party, called the accusation \"a grave political provocation against the DPRK\" and \"absurd rhetoric and nothing new.\" Her statement was carried by the state news agency KCNA on Tuesday, per [Asharq Al-Awsat](https://english.aawsat.com/world/5336930-north-korea-says-accusations-linking-it-binance-heist-are-%E2%80%98grave-political) and [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor).\n\nThe denial lands against a growing body of evidence from the U.S. government, three independent blockchain-analytics firms and Binance itself. It also fits a familiar pattern. Pyongyang has rejected every previous attribution of a major crypto theft, including the $1.46 billion Bybit raid in February 2025. This story sets out what the FBI said and what the on-chain investigators found. It covers what Binance has disclosed about the breach, what North Korea says in reply, and what no one can yet show.\n\n## What the FBI said\n\nOn October 31, two days after the theft, the FBI published an alert naming North Korea. In a post from its Cyber Branch account on X, the bureau wrote that it \"is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026.\" It added that it \"refers to this specific North Korean malicious cyber activity as 'TraderTraitor,'\" per the [FBI Cyber Branch post](https://x.com/FBICyberBranch/status/2116660730745299426) as indexed by a search engine. The live post and the [FBI alert page](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) would not open for our tools.\n\nThe alert was issued with the U.S. Secret Service and IRS Criminal Investigation. It said investigators had \"observed TraderTraitor actors converting stolen assets primarily into Ethereum.\" It expected the funds to be \"further laundered by converting them using DeFi and instant swap services.\" It published a list of wallet addresses and asked exchanges and other crypto businesses to block transactions involving them, per [The Hacker News](https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html) and [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor). The bureau has not released its forensic findings.\n\nTraderTraitor is the FBI's name for a North Korea-aligned group that security firms also track as Jade Sleet, UNC4899 and Slow Pisces. The bureau blamed the same group for the Bybit theft, per [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor). The FBI is led by [Kash Patel](https://567politics.com/politicians/kash-patel); we found no statement from him personally on the Binance case.\n\nPresident Trump, asked about the theft at his Florida residence on Saturday before the FBI alert was widely reported, said: \"I'm not concerned. We're learning about it. We don't know if it's North Korea,\" per [Asharq Al-Awsat](https://english.aawsat.com/world/5336930-north-korea-says-accusations-linking-it-binance-heist-are-%E2%80%98grave-political). We found no later comment from [the president](https://567politics.com/politicians/donald-trump) reconciling that remark with the bureau's finding.\n\n## How the theft unfolded\n\nBinance's own account was reported by Fox Business on Tuesday. The attack began with a fake job interview used to compromise an employee's computer, which Binance earlier described as a DevOps engineer's laptop. That machine gave access to an internal service container, from which unauthorized withdrawal requests were submitted. The attackers used Binance's internal AI tool to help execute the transactions. Binance says it has found no evidence that wallet private keys were compromised, per [Fox Business](https://foxbusiness.com/fox-news-tech/binance-details-how-fake-job-interview-led-6-3b-crypto-heist). An earlier Binance update referred to \"additional points of breach\" without naming them, per [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/).\n\nThe on-chain record, reconstructed by Elliptic, TRM Labs and Chainalysis, shows preparation at least a day in advance. The attacker's wallet received three small withdrawals from the Tornado Cash mixer on October 28 and 29. A \"sweeper\" contract was deployed at 15:59 UTC on October 29 and rehearsed about four hours before use. At 20:20 UTC, a single Ethereum transaction carried 50 pre-signed authorizations that handed control of a Binance hot wallet to that contract. At 20:24, $2.53 billion left in one transfer. Funds then moved off Bitcoin, Tron, the XRP Ledger, Solana, NEAR, Base, Optimism, Arbitrum, Avalanche and Polygon over about three hours, per [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/) and a [Stingrai summary of TRM's timeline](https://www.stingrai.io/blog/binance-hack-october-2026).\n\n**The Binance theft and the response, times in UTC**\n\n* **2026-10-28**: Attacker wallet funded with small Tornado Cash withdrawals\n* **2026-10-29**: 15:59 sweeper contract deployed; 20:20 Binance wallet delegated; 20:24 $2.53 billion moves\n* **2026-10-29**: 21:01 Tether freezes a wallet holding 1.18 billion USDT; 21:04 Circle freezes 823 million USDC\n* **2026-10-30**: 00:13 Binance suspends withdrawals and says it will cover all losses\n* **2026-10-31**: FBI attributes the theft to TraderTraitor\n* **2026-11-01**: Binance begins reopening withdrawals, starting with Bitcoin\n* **2026-11-03**: KCNA carries Kim Yo Jong's denial\n\nSource: [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/), [Stingrai](https://www.stingrai.io/blog/binance-hack-october-2026)\n\nEstimates of the total differ by a few percent depending on the price used and which transfers are counted. Binance put the impact at about $6.3 billion. Elliptic counted $6.43 billion across 11 blockchains. It excluded a further $169 million moved after withdrawals were suspended, which it attributes to Binance's own funds. Chainalysis's first estimate was about $5.9 billion, per [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/) and [Stingrai](https://www.stingrai.io/blog/binance-hack-october-2026). Four assets made up 74 percent of the haul: Tether and USD Coin on Ethereum, Bitcoin and Tether on Tron.","textStyle":"body","layout":"text"},{"role":"htmltable","html":"<table><tr><th>Asset</th><th>Amount taken</th><th>Status</th></tr><tr><td>Ethereum-chain assets</td><td>$3.80 billion across 186 tokens</td><td>Stablecoins largely frozen; ETH not</td></tr><tr><td>Bitcoin</td><td>18,270 BTC (about $1.48 billion)</td><td>Beyond freeze; split into 19 addresses</td></tr><tr><td>Tether on Tron</td><td>612.7 million USDT</td><td>Partly swapped to TRX before freezes</td></tr><tr><td>XRP</td><td>233 million XRP</td><td>Unfrozen; had not moved</td></tr></table>","layout":"text"},{"role":"body","format":"markdown","text":"Source: [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/), figures as of its November 1 update, with theft values at the time of the theft and later values at current prices.\n\n## What was frozen and what was not\n\nStablecoin issuers can freeze tokens; no one can freeze bitcoin or ether. That distinction shaped the recovery. Tether froze a wallet holding 1.18 billion USDT 37 minutes after the funds arrived, and later froze four more addresses. Circle froze 823 million USDC about three minutes after Tether's first action. Ripple, World Liberty Financial, Paxos and First Digital froze their own tokens. The Arbitrum and Optimism networks used chain governance to secure everything stolen on them. Elliptic verified $2.85 billion frozen or seized, 44 percent of the theft, 94 percent of it in stablecoins. Binance's own estimate is about $3 billion, per [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/).\n\nAbout $3.25 billion remained beyond reach across more than 800 addresses as of November 1, including roughly 584,000 ETH, 18,327 BTC and the 233 million XRP. Before the freezes landed, the attackers converted about $786 million of stablecoins into ETH and TRX. They sold 434 million USDT for 160,451 ETH through decentralized exchanges at an implied loss of 12 to 26 percent, a price they were evidently willing to pay for speed, per [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/).\n\n**Largest crypto thefts attributed to North Korea, millions of dollars**\n\nValues at the time of each theft; Bitget figure per Bitget's own disclosure","textStyle":"body","layout":"text"},{"role":"htmltable","html":"<table><tr><th>Theft</th><th>Millions</th></tr><tr><td>Binance, Oct. 2026</td><td>$6,430</td></tr><tr><td>Bybit, Feb. 2025</td><td>$1,460</td></tr><tr><td>Ronin/Axie Infinity, 2022</td><td>$620</td></tr><tr><td>Bitget, Sept. 2026</td><td>$352</td></tr></table>","layout":"text"},{"role":"body","format":"markdown","text":"Source: [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/), [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor), [Wikipedia on Lazarus Group](https://en.wikipedia.org/wiki/Lazarus_Group)\n\nElliptic says the Binance theft \"almost doubles the total cryptoassets stolen by the regime,\" which it had put at more than $6.5 billion over recent years, including more than $1 billion in 2026 before this incident, per [The Hacker News](https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html). Those are the firm's estimates, not audited totals.\n\n## The case for attribution, and its limits\n\nThree analytics firms reached the same conclusion before the FBI did. TRM Labs attributed the theft to TraderTraitor \"with high confidence.\" Chainalysis cited \"a high degree of confidence that DPRK is responsible.\" Elliptic set out four reasons. First, the stolen funds were laundered together with proceeds of the September Bitget exploit, a link first reported by the independent investigator ZachXBT. Second, the wallets used the same services as earlier TraderTraitor thefts from BigONE, WOO X and AFX. Third, the method resembled Bybit, with long preparation, targeting of staff and use of the exchange's own signing systems. Fourth, few actors could coordinate withdrawals across 11 blockchains in three hours, per [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/). Elliptic also found signs of automation in the laundering, including 1,113 Tron transfers with a median gap of 90 seconds and amounts randomized to six decimal places. It said the on-chain data cannot show whether AI agents were involved.\n\nThe limits are real too, and Elliptic lists them. Binance has not published a root cause. Its first explanation, the laptop, was followed by the unspecified \"additional points of breach.\" The exchange initially found no private-key leak, while the on-chain data suggest its signing infrastructure was manipulated. The FBI's attribution \"confirms but does not change\" Elliptic's assessment, and the Bitget link came from a third party, per [Elliptic](https://www.elliptic.co/insights/binance-largest-hack-in-history/).\n\nA sharper caution came from Vasily Vidmanov, chief operating officer of the compliance firm AMLBot: \"Onchain analysis can link wallets to one actor. It can't prove nationality or state sponsorship.\" If the funds follow the laundering route of earlier North Korea-attributed thefts, he said, that would answer the denial better than any statement, per [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor). That is the gap the FBI's unpublished forensics would need to close. Linking a cluster of wallets to a known group is on-chain work. Linking that group to a government relies on intelligence the bureau has not shown.\n\nAttribution disputes of this kind are not unique to crypto. Our report on the [second wave of refrigeration cyberattacks on European supermarkets](https://567politics.com/news/europe-supermarket-refrigeration-cyberattacks-second-wave-november-2026) found governments split on who was behind them. The [German warning about spyware on Bundestag iPhones](https://567politics.com/news/germany-bundestag-iphones-spyware-bsi-apple-warning-november-2026) turned on similar questions of what public evidence can show.\n\n## What North Korea says\n\nKim Yo Jong's statement, dated Monday and published by KCNA on Tuesday, called the FBI finding \"a trite provocation of linking it with the Democratic People's Republic of Korea again.\" She said it was \"a grave political provocation against the DPRK that the US misleads international public opinion\" by acting \"as if all the cybercrimes in different parts of the world are our deeds.\" She said \"it is the consistent policy stand of the DPRK government to resolutely oppose all sorts of malicious acts in cyberspace.\" She added: \"We have issues to reconsider in diverse aspects as regards the very unpleasant US hostile attitude,\" per [Asharq Al-Awsat](https://english.aawsat.com/world/5336930-north-korea-says-accusations-linking-it-binance-heist-are-%E2%80%98grave-political) and [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor). We could not open KCNA directly and rely on those outlets' transcriptions.\n\nThe statement offered no evidence and did not address the specific wallets, services or methods described by investigators. That is consistent with Pyongyang's past responses. Kim also disputed the Bybit attribution in 2025, and in May 2026 North Korea called U.S. cyber-threat accusations \"absurd slander\" and warned of countermeasures, per [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor) and [BeInCrypto](https://beincrypto.com/north-korea-denies-cyber-threat-claims/). The longer record includes the U.S. Treasury's 2019 sanctions on the Lazarus Group, Bluenoroff and Andariel, which it said were controlled by North Korea's military intelligence agency. It also includes a 2021 Justice Department indictment of three North Korean military hackers for attempting to steal or extort more than $1.3 billion, per [CoinDesk](https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor). Sanctions and indictments are government findings and charges, not court verdicts; none of the indicted individuals has been tried.\n\n## What Binance has promised its users\n\nBinance suspended deposits and withdrawals at 00:13 UTC on October 30 and said it would cover all losses. Its co-founder Yi He said deposits were unaffected and withdrawals would resume within 48 hours. They began reopening on November 1, starting with Bitcoin, and Binance later said all 15 networks were back. In the first nine and a half hours, users withdrew $4.65 billion and deposited $1.01 billion, a net outflow of about $3.64 billion, per [The Hacker News](https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html) and [Stingrai](https://www.stingrai.io/blog/binance-hack-october-2026).\n\nOn Tuesday the exchange said that \"users will not bear the financial impact of this incident.\" It said it had replenished about 90 percent of the stolen assets, roughly $6 billion, from its Secure Asset Fund for Users and company funds. It said bitcoin, ether, tether and BNB balances remain fully backed. Co-CEO Richard Teng told Fox Business that customers will not bear losses. The company said it would invest more in AI-powered threat detection, set up a security research fund and work with leading AI companies, per [Fox Business](https://foxbusiness.com/fox-news-tech/binance-details-how-fake-job-interview-led-6-3b-crypto-heist). Binance says it has more than 335 million users and average daily trading volume of $95 billion, per [Asharq Al-Awsat](https://english.aawsat.com/world/5336930-north-korea-says-accusations-linking-it-binance-heist-are-%E2%80%98grave-political). We could not open Binance's own incident recap on its blog. The figures above are as reported by the outlets named.\n\nThose commitments are the company's statements. No independent audit of the replenishment had been published on any page we could open. Binance has not said how much of the $6 billion came from the SAFU fund, which it has previously described as about $1 billion, versus corporate funds.\n\n## What people were saying online\n\nWe set out to sample reactions on X and in r/worldnews, r/geopolitics, r/CryptoCurrency and r/politics between 1 a.m. and 2 a.m. Eastern on November 4. Reddit's listings, including the JSON feeds, were blocked to our tools. X's explore pages refused automated access, so we could read neither platform's rankings. Our permalink-verification tool failed on every X link we tried. What follows is drawn from search-engine indexing of X posts, which shows text but not live engagement counts. We quote only institutional and news accounts whose identity is not in doubt.\n\nThe FBI Cyber Branch's own post was the most-indexed item on the attribution. Financial-news accounts relayed it within the hour. The Kobeissi Letter called it \"the largest hack in history\" and noted the earlier Bybit attribution, per [its post](https://x.com/KobeissiLetter/status/2116669713430282667). Watcher.Guru posted \"FBI confirms North Korea is responsible for the $6,300,000,000 Binance crypto hack,\" per [its post](https://x.com/WatcherGuru/status/2116644116872519909). The Argentine outlet Corta, writing in Spanish, framed Kim's reply as calling the accusation \"another violation of the sovereignty\" of her country, per [its post](https://x.com/somoscorta/status/2117439491984306248). We found no indexed posts from accounts credibly self-identified as inside North Korea, which has no public internet access for ordinary citizens. We found no representative survey of opinion in any country on the attribution. This section describes selected online reactions, not what the public thinks.\n\n## What remains unknown\n\nThe root cause. Binance has described a laptop, a service container, an internal AI tool and unspecified additional breach points, but not published a full account.\n\nThe FBI's evidence. The bureau has published wallet addresses, not the forensic basis for naming a state.\n\nWhere the unfrozen $3.25 billion goes. Elliptic expects layering through wallets, bridges, mixers and over-the-counter brokers; as of November 1 the XRP, SOL and NEAR holdings had not moved.\n\nAny U.S. government response beyond the alert. We found no new sanctions designation, indictment or statement from [Treasury Secretary Scott Bessent](https://567politics.com/politicians/scott-bessent) tied to this theft on any page we could open.\n\n## Sources and method\n\nReported between 1 a.m. and 2 a.m. Eastern on November 4, 2026. Pages we opened: Elliptic's analysis (updated November 1), The Hacker News, CoinDesk, Asharq Al-Awsat, Fox Business, the Stingrai summary of TRM Labs and Chainalysis data, BeInCrypto and Wikipedia's Lazarus Group entry. The FBI alert page, Binance's blog, The Hill, NBC News, SecurityWeek, The Japan Times and CNBC were blocked to our fetch tool. Where we cite the FBI's wording we name the outlet that carried it. Reddit and X could not be opened or verified; posts above are quoted as indexed by a search engine. Our standards for sourcing and corrections are on our [methodology page](https://567politics.com/methodology).","textStyle":"body","layout":"text"}]}