North Korea Denies $6.3B Binance Hack, Calls FBI Finding a 'Political Provocation'

What it is

North Korea denied on Tuesday (3 November 2026) that it hacked Binance. The FBI said on Saturday that the group it calls TraderTraitor stole more than $6 billion (the page puts the total at $6.43 billion). TRM Labs and Chainalysis had made the same attribution the week before. The FBI attributes the $1.5 billion Bybit theft of February 2025 to the same group.

Kim Yo Jong, sister of leader Kim Jong Un, called the finding a "grave political provocation" in a statement carried by the state-run Korean Central News Agency. The statement also pointed to the Trump administration's plan to use confiscated crypto as a strategic reserve and said the beneficiary of recovered funds "may" indicate who is behind the hack. The page notes North Korea has denied earlier accusations too.

How the laundering is progressing

• Decrypt reported on Monday that funds move at roughly one new wallet every 25 seconds, across about 12,000 wallets.
• Chainalysis says this matches the "immediate layering" phase seen after past North Korean hacks. Funds repeatedly return to earlier addresses across thousands of transactions, which Chainalysis reads as automation.
• As of 2 November, more than $1 billion in ETH and about $1.42 billion in BTC had seen limited onward movement. Other funds are moving quickly across chains.
• Chainalysis expects the scale to "strain the actors' trusted laundering channels" and push funds toward bridges, instant exchanges and swapping services.
• About $2.85 billion of the $6.43 billion is frozen or seized, against roughly 3% for Bybit.

What to do

The page gives no commands, addresses or indicators. For teams that run exchange, bridge or swap services, the actionable point is Chainalysis's forecast of where the funds will go next. The page does not state any response steps.

Binance's position

• Net withdrawals reached $4.72 billion since withdrawals resumed on Sunday, which a spokesperson called a "relatively limited portion" of about $157 billion in assets.
• Hourly deposits exceeded withdrawals from 10 p.m. ET on Monday, and withdrawals were restored for dozens more tokens on Ethereum and Solana.
• Holders of the 10 largest tokens (including BTC, ETH, USDT and USDC) can verify full backing with a zero-knowledge proof of the 31 October reserves snapshot.
• Binance says it has covered about 95% of the stolen assets. The rest are less liquid tokens that take longer to buy. A wider snapshot is planned for Wednesday.

Caveats

Binance did not answer the BBC's questions about North Korea's involvement. The page does not say how the breach happened.