North Korea denies role in $6 billion Binance hack after FBI accusation

Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed US claims linking the country to the Binance hack as "absurd rhetoric," Reuters reported on Nov. 2, citing the Korean Central News Agency, or KCNA. The denial disputes the US government's attribution of the theft of more than $6 billion from the cryptocurrency exchange.

The FBI had blamed North Korea's TraderTraitor operation in an Oct. 31 alert, placing the theft on or about Oct. 29. TraderTraitor is the bureau's name for the specific North Korean cyber activity it identified in the attack.

Blockchain intelligence firm TRM Labs estimated that approximately $6 billion left Binance wallets across ten blockchains, with most of the funds moving in about 20 minutes beginning at 20:05 UTC on Oct. 29. The firm's initial figures reflected observations through 00:30 UTC on Oct. 30.

TRM attributed the Binance hack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence.

The firm also assessed that valid signed transfers across different blockchains pointed to a compromise of Binance's hot-wallet signing infrastructure. That would place the breach in the systems used to authorize outgoing wallet transactions. The explanation remains TRM's assessment of how the transfers were enabled. Its conclusion connects the ability to produce valid transfers on different networks with a potential weakness in the infrastructure used to sign those transactions.

FBI seeks to block transactions linked to the Binance hack

The FBI said investigators working with the US Secret Service and IRS Criminal Investigation had observed the actors converting stolen assets primarily into ether. The bureau expected further laundering through decentralized finance, or DeFi, and instant-swap services.

The alert urged cryptocurrency service providers to block transactions involving the listed theft-linked addresses. It described those wallets as operated by, or closely connected to, TraderTraitor actors. CryptoSlate reported the FBI attribution and blocking appeal on Nov. 1, before the North Korean denial.

The request extends beyond exchanges to blockchain infrastructure operators, DeFi services and analytics firms. The FBI specifically named THORNode operators, RPC node operators and instant exchanges, alongside decentralized services and other businesses that handle virtual assets. It covers transactions involving both the identified addresses and funds derived from them.