North Korea denies the Binance hack. On Tuesday, Kim Yo Jong, the sister of Kim Jong Un, called the FBI’s attribution “a trite provocation” through state news agency KCNA. The FBI disagrees. It formally named North Korea’s TraderTraitor unit on October 31, and the US Secret Service confirmed it has been tracing and freezing the stolen funds since the first minutes of the attack. This post covers what each side said, why the evidence points one way, and the one viral claim about North Korea’s GDP that doesn’t survive a fact check.
What North Korea Said
The statement came from the top. Kim Yo Jong is one of the most powerful officials in the country, and she handles most of Pyongyang’s messaging toward Washington. Her words carried the usual tone. She called the FBI announcement “absurd rhetoric and nothing new” and accused the US of blaming North Korea for every cyber crime that makes international headlines.
Then she went a step further. Without offering any evidence, she hinted that the US itself could have been behind the theft. The same statement also rejected the FBI’s attribution of the Bybit hack from February 2025. So within a few sentences, Pyongyang denied the two biggest crypto heists in history.
Timing matters here. North Korea has ramped up weapons tests in recent weeks, while President Trump has said he wants to restart talks with Kim Jong Un. Kim Yo Jong closed by saying the regime now has “issues to reconsider” about the US attitude. In other words, the denial is as much a diplomatic move as a cyber one.
What the FBI and Secret Service Have on Record
The US side built its case fast. Here’s the timeline:
- October 29: Attackers drain roughly $6.3 billion from Binance hot wallets across ten blockchains. Within minutes, Secret Service investigators start working with industry partners to identify and freeze funds.
- October 30: Reuters reports that both the FBI and Secret Service have joined the investigation. Circle freezes over $800 million in USDC, later raised to more than $1.1 billion.
- October 31: Trump, asked about it on Friday, says “we don’t know if it’s North Korea.” Hours later, the FBI publishes an alert titled “North Korea Responsible for $6 Billion Binance Attack.” It names TraderTraitor, releases wallet addresses on Ethereum, Bitcoin and Solana, and warns that the stolen assets are being converted into ETH.
- November 1: The Secret Service confirms its investigation continues alongside the FBI, IRS Criminal Investigation and the Department of Justice. CZ publicly thanks the agency for acting within minutes.
Roughly $3 billion is frozen so far. The rest sits mostly in BTC and ETH, which no issuer can freeze. The full picture of how the breach happened is in our Binance hack post mortem, which we keep updating as Binance releases details.
Why Nobody in Crypto Believes the Denial
The attribution didn’t start with the FBI. Blockchain analytics firms got there first, and they got there independently.
TRM Labs attributed the attack to TraderTraitor with high confidence within a day, citing both onchain and offchain intelligence. Chainalysis named the same unit. Elliptic assessed North Korea as the likely culprit before the FBI said a word. Three competing firms reaching the same conclusion is rare.
The onchain behaviour sealed it. After Bybit, the hackers converted everything into ETH, then pushed it through DeFi protocols and instant swap services. The Binance funds are moving the exact same way. Laundering patterns are like handwriting. Groups rarely change them, because the infrastructure behind them takes years to build.
The entry method fits too. Binance says the breach began with a compromised DevOps laptop. According to TRM, only 13 of North Korea’s 100 attributed crypto incidents were code exploits. The rest went after people who control the keys. Two days before the hack, Binance had even announced it blocked a week of North Korea-linked attempts using fake job interviews. Our earlier breakdown of Lazarus Group’s hack trail shows this playbook going back to the Ronin bridge in 2022.
Every Hack Comes With a Denial
Pyongyang has never admitted to a single one. That track record is worth remembering when you read this week’s statement.
In 2014, it denied hacking Sony Pictures, even as the FBI laid out the evidence. In 2017, it denied releasing WannaCry, the ransomware that shut down hospitals across the UK. When the US indicted programmer Park Jin Hyok in 2018 for Sony, WannaCry and the $81 million Bangladesh Bank theft, North Korea’s response was that he doesn’t exist. A “non-entity,” the foreign ministry called him.
Bybit followed the same script. The FBI attributed that $1.5 billion theft within five days. North Korea said nothing for months, then rejected it this week alongside Binance. Meanwhile, ZachXBT spent his own money infiltrating the laundering syndicate that moved the Bybit funds, and the trail led straight back to the same network.
Bitget’s CEO blamed North Korea for the $350 million Bitget hack in September. No denial came for that one. Pyongyang only responds when the FBI puts its name on paper.
The GDP Rumour, Fact Checked
Several viral posts this week claimed North Korea has now stolen more crypto than its entire GDP. I saw them too, and I wanted to use the line. It doesn’t hold up.
TRM Labs puts total North Korean crypto theft at $12.8 billion since 2017. The Bank of Korea estimates North Korea’s 2025 GDP at around $26.6 billion. So the lifetime haul equals roughly half of one year’s output, not more than it. The 2026 total of $7.4 billion is about 28% of GDP on its own, and Binance alone is around 24%.
Those are still staggering numbers for a state actor. One honest comparison does work, though. North Korea exported about $469 million in merchandise in 2025. Its hackers took 27 times that amount in crypto since 2017, and 13 times that in a single afternoon at Binance. Crypto theft isn’t a side hustle for this regime. It’s the main export.
When I Started Taking Lazarus Seriously
I had funds on Bybit when it got hit in February 2025. Until that day, Lazarus was a name I’d read in post mortems about other people’s losses. Ronin, Harmony, Atomic Wallet. Bad, but distant.
Bybit changed that. I was withdrawing my own balance while tweeting warnings to our community, and for the first time I was reading the FBI’s TraderTraitor alerts as a user, not a reporter. That was when North Korea became an attack vector I actively plan around. Not a headline. A threat model.
Nothing about this week surprised me, because the pattern was already clear. The denial, the diplomatic framing, the laundering through ETH. I’d seen all of it once before. The lesson I took from Bybit still stands: when withdrawals are open and the news is bad, move to self custody first and form opinions later. The Bybit hack post mortem has the full story of how that one unfolded.
What This Means for You
State-level attackers change the math for exchange users. A few practical takeaways:
- Denials mean nothing for your funds. Whether Pyongyang admits it or not, the money is gone and the next attempt is already in motion.
- Frozen is not recovered. Around $3 billion is frozen, but getting it back to Binance takes legal processes that run for months or years. Our guide on whether stolen crypto can be recovered explains why.
- Watch the laundering, not the headlines. When the FBI says funds are moving into ETH and through mixers and swap services, that selling pressure is real and hits the market.
- Spread your exposure. Binance covered every user this time. The next exchange may not have a $6 billion reserve to draw on.
Binance has since restored withdrawals and published an updated proof of reserves. The live coverage, including every update since October 29, is in our Binance hack coverage.
Keep This Content Free
We had the Binance hack live on this site within minutes of the first rumours, and we’ve updated it daily since. That speed costs time and money. If you want to support the work, trade through our partner exchanges. It costs you nothing and we earn a small share of the fees.
Support us through OKX or Bybit.
Prefer to earn while you trade? Our trading airdrops hub tracks every live exchange bonus, trading competition and perp DEX points program.
Final Words
North Korea denies the Binance hack. The FBI, Secret Service, TRM Labs, Chainalysis and Elliptic all say North Korea did it. Add a decade of identical denials for Sony, WannaCry and Bybit, and the picture is clear. The statement from Pyongyang is a diplomatic chess move, not a defence.
For users, the lesson is older than this hack. Withdraw first when the alarm goes off, keep only trading capital on exchanges, and treat Lazarus as a permanent part of your threat model. I learned that on Bybit. I’d rather you learned it here.
FAQ
Did North Korea deny the Binance hack?
Yes. On Tuesday, Kim Yo Jong rejected the FBI’s attribution through KCNA, calling it “a trite provocation” and suggesting the US itself could be involved. She rejected the Bybit attribution in the same statement.
Who does the FBI say hacked Binance?
The FBI attributes the $6.3 billion theft to TraderTraitor, a North Korean state-sponsored unit inside Lazarus Group. It published the attribution on October 31, along with wallet addresses linked to the attackers.
What role did the Secret Service play?
The Secret Service began tracing and freezing stolen funds within minutes of the attack and continues to investigate with the FBI, IRS Criminal Investigation and the Department of Justice. CZ publicly thanked the agency for its speed.
Has North Korea stolen more crypto than its GDP?
No. Total North Korean crypto theft stands at about $12.8 billion since 2017, while the Bank of Korea estimates the country’s 2025 GDP at around $26.6 billion. The haul equals roughly half of annual GDP, but about 27 times the country’s yearly merchandise exports.
Has North Korea ever admitted to a crypto hack?
No. Pyongyang has denied every attribution, including Sony Pictures in 2014, WannaCry in 2017, Bybit in 2025 and Binance in 2026. It once claimed an indicted hacker did not exist.
How much of the Binance hack has been frozen?
Roughly $3 billion, including over $1.1 billion in USDC frozen by Circle. The remainder sits mostly in BTC and ETH, which cannot be frozen by any issuer.
Credit: Source link
