Kim Yo Jong called the FBI’s accusation a “grave political provocation,” while Binance said it was replacing stolen assets and gradually restoring withdrawals after the largest cryptocurrency theft on record.
North Korea has rejected the FBI’s accusation that its state-backed hackers stole approximately $6.3billion from Binance, as the cryptocurrency exchange works to replenish affected assets and restore services following a record-breaking breach.
Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, dismissed the allegation as “absurd rhetoric and nothing new” in a statement carried by the state-run Korean Central News Agency. She described Washington’s attribution as a “grave political provocation” and accused the United States of using major cyber incidents to discredit Pyongyang.
The denial followed an October 31 FBI statement attributing the theft to North Korean malicious cyber activity it calls TraderTraitor. The agency said more than $6 billion in virtual assets had been stolen from Binance on or around October 29.
The dispute has unfolded alongside a major test of customer confidence. Binance customers withdrew a net $4.72billion after withdrawals began reopening on November 1, according to reporting published the following day. Binance said withdrawal volumes had slowed after an initial surge, while analysts described the departures as relatively modest compared with the assets held on the platform.reuters+1
How attackers breached Binance
Binance has linked the theft to a compromised laptop belonging to a DevOps engineer, an employee working on the systems used to develop and operate its platform. According to the exchange’s account, reported by BleepingComputer, the compromise allowed attackers to access a service container and submit unauthorized withdrawal transactions.
Blockchain intelligence firm TRM Labs estimated that approximately $6.36billion moved out of Binance wallets across 10 blockchains, with most of the transfers completed in about 20 minutes. Chainalysis also attributed the attack to TraderTraitor with a “high degree of confidence,” according to the same reporting.
Either figure places it well above the roughly $1.5billion Bybit theft in February 2025, which was also attributed to North Korean hackers.
The FBI’s public statement identifies North Korea as responsible but provides limited detail about the evidence underpinning that attribution. It says investigators, working with the US Secret Service and the Internal Revenue Service’s criminal investigation division, observed the attackers converting stolen assets primarily into ether, the cryptocurrency used on the Ethereum network.
Investigators expect further laundering through decentralized finance platforms and instant-swap services. Those services can allow assets to be exchanged or moved through additional transactions as attackers attempt to obscure their origin.
Replacing customer assets is not the same as recovering the stolen funds
Binance has pledged to cover the losses rather than pass them on to customers. Reuters reported that the exchange had raised approximately $6billion from its corporate treasury, an insurance fund and a fund reserved for security breaches.
By November 1, Binance said it had replenished approximately 95% of the affected assets. The remaining portion consisted of less-liquid tokens that it was continuing to purchase through market and over-the-counter transactions, according to a statement reported by BleepingComputer.
That distinction matters: replenishment means Binance is replacing missing assets using other resources, not necessarily that investigators have recovered the cryptocurrency taken by the attackers. Separately, stablecoin issuers have frozen a substantial portion of the stolen funds. Reuters reported that about half the haul consisted of stablecoins that had been frozen, including more than $1.1billion in USDC frozen by issuer Circle.
The two efforts address different problems. Binance’s replacement purchases aim to restore the assets available to customers, while freezes seek to prevent the attackers from moving or cashing out stolen tokens.
Withdrawals test customer confidence
Binance began gradually reopening withdrawals on Sunday, November 1, after suspending them in the aftermath of the attack. During the first nine and a half hours, customers withdrew approximately $4.65billion and deposited $1.01billion, producing a net outflow of $3.64billion.
The gross and net figures measure different things: gross withdrawals count all assets leaving the platform, while net outflows subtract incoming deposits. Binance said the initial $3.64billion net departure represented 2.1% of the assets on its platform.
After an initial spike, withdrawal volumes have declined and are stabilising.
Binance said in a statement quoted by Reuters.
Tim Sun, a senior researcher at digital-asset financial services company HashKey Group, told Reuters that the incident had “not yet triggered widespread panic or a massive, concentrated withdrawal.” He nevertheless warned that security concerns could influence how much market makers, institutions and other investors allocate to cryptocurrency.
Those early figures do not settle the longer-term question of customer confidence. Withdrawals were still partially suspended for many cryptocurrencies on Monday, according to Reuters, making the reopening an ongoing process rather than a completed stress test.
Binance subsequently announced another expansion of withdrawals across networks including Binance Smart Chain, Ethereum, Solana, XRP and Sui, scheduled to begin at 04:00 GMT on Tuesday, November 3.
Why Pyongyang’s denial matters
North Korea’s response has implications beyond the exchange itself. Researchers have linked the country’s cryptocurrency theft operations to financing its weapons programs, while a 2024 United Nations report said proceeds from North Korean cyberattacks had reportedly helped fund weapons of mass destruction development. That broader assessment does not establish how the proceeds of this particular theft might ultimately be used.
Michael Bosack, founding director of the Parley Policy Institute and a former UN Command official, told AFP that the international attention surrounding the Binance attack likely helped prompt Pyongyang’s response. He argued that the denial was intended to preserve channels through which stolen cryptocurrency could be laundered and used.
If external parties start closing doors based on the international heat on the matter, then the stolen cryptocurrency does nothing to support the Kim regime’s near-term priorities.
Bosack said.
Kim Yo Jong also said North Korea now had “issues to reconsider” because of Washington’s hostility, introducing another complication as US President Donald Trump seeks to revive summit diplomacy with Pyongyang.
Missile test adds to regional tensions
Separately, North Korean state media reported that the country tested strategic cruise missiles on Monday equipped with a new cluster-munition warhead. KCNA described the test as an improvement in the missiles’ ability to strike targets through their terminal flight manoeuvres.
The launch occurred alongside the public dispute over the Binance theft, but the available reporting does not establish that it was ordered in response to the FBI’s accusation. Analysts quoted by AFP instead discussed its significance for North Korea’s conventional strike capabilities and deterrence against South Korea.
The cyberattack has also prompted calls for stronger digital defenses in Seoul. South Korean President Lee Jae-myung cited the enormous losses suffered by the world’s largest cryptocurrency exchange while urging a more comprehensive approach to preventing cyberattacks, rather than relying primarily on inspections and responses after an incident.
For Binance, the immediate challenge remains restoring services securely while replacing affected assets. For investigators, it is turning the tracing of stolen cryptocurrency into coordinated action before the attackers can move it beyond reach—a difficulty asset-recovery specialist Jonathan Benton described to Reuters as the gap between identifying funds and acting quickly enough to secure them.
