North Korea has flatly rejected U.S. law enforcement findings that it orchestrated the $6.3 billion Binance hack, with Kim Yo Jong, the sister of leader Kim Jong Un, characterising the FBI’s attribution as a “grave political provocation” designed to damage Pyongyang’s international standing.
According to reporting by Decrypt, Kim’s statement, carried by state-run Korean Central News Agency, dismissed accusations that North Korean hackers linked to the group TraderTraitor were responsible for the theft. She called the attribution a “sinister” attempt to tarnish the country’s image and pivoted blame back toward Washington, specifically referencing the Trump administration’s plans to use recovered cryptocurrency as a strategic asset reserve.
“Anyone who looks at who will end up with the so-called stolen cryptocurrency once it is retrieved may get a clue about who is behind the hacking incident,” Kim said, suggesting the U.S. has motive to fabricate the attribution.
FBI Attribution Stands Firm
The FBI, alongside the Secret Service and blockchain analytics firms TRM Labs and Chainalysis, attributed the Binance theft to TraderTraitor last weekend. The same group has been blamed for the $1.5 billion hack of crypto exchange Bybit in February 2025—a connection that strengthens the attribution even as North Korea maintains its denial.
This is not Pyongyang’s first denial. North Korea has rejected previous hacking accusations despite mounting evidence from U.S. and private-sector investigators. The consistency of the denials, paired with the technical sophistication required to execute a theft of this scale, underscores how attribution disputes have become standard practice when nation-state actors face allegations.
Rapid Money Movement Strains Laundering Infrastructure
While diplomatic posturing continues, blockchain forensics reveal the scale of the operational challenge facing the hackers. According to Chainalysis data, stolen funds are moving through roughly 12,000 wallets at a rate of approximately one new address every 25 seconds—a velocity that suggests both urgency and sophisticated automation.
About $2.85 billion of the $6.43 billion stolen has been frozen or seized so far, a recovery rate substantially higher than the 3% recovered from the Bybit theft. Ethereum and Bitcoin holdings tell different stories: more than $1 billion in ETH and approximately $1.42 billion in BTC have experienced limited onward movement, while other assets are crossing chains at rapid speed.
Chainalysis expects the sheer volume of funds to “strain the actors’ trusted laundering channels,” forcing movement toward bridges, instant exchanges, and decentralised swapping services. The pattern mirrors the “immediate layering” phase seen after prior North Korean operations, though the repetitive return of funds to earlier addresses across thousands of transactions suggests heavy reliance on automated processes rather than human decision-making.
Binance Stabilises, Deposits Begin Outpacing Withdrawals
Binance has managed a staged recovery since resuming withdrawals on Sunday. The exchange reported net withdrawals of $4.72 billion through Monday evening—described internally as a “relatively limited portion” given total assets of approximately $157 billion.
A significant turning point came late Monday: hourly deposits began exceeding hourly withdrawals, signalling what Binance characterised as “improving user activity and stabilising flows.” The exchange has since restored withdrawals across dozens of additional tokens on Ethereum and Solana networks.
On the transparency front, Binance deployed zero-knowledge proofs to verify that users holding its 10 largest tokens—including BTC, ETH, USDT, and USDC—have fully backed balances as of October 31. The company has covered approximately 95% of stolen assets through replenishment, with the remaining 5% consisting of less liquid tokens requiring longer acquisition timelines. Binance plans to publish a wider reserve snapshot on Wednesday.
The incident represents a stress test for institutional confidence in centralised exchange security, even as Binance’s rapid response and visible recovery efforts work to contain reputational damage. Whether the exchange’s crisis management translates into sustained user retention remains an open question in a market where trust erodes quickly.