Binance (BNB) Hack: North Korea Denies FBI's $6.3B Attribution

By Nodora News · 3 November 2026

North Korea denies the FBI's claim that it was behind the $6.3B Binance hack, with Kim Yo Jong calling it a political provocation. BNB holds near $699.

North Korea has publicly denied any role in the record $6.3 billion hack of Binance, the exchange behind BNB (BNB), rejecting the FBI's finding that a North Korean state-backed group carried out the attack. In a statement dated November 2 and carried by the Korean Central News Agency (KCNA) on November 3, Kim Yo Jong, the sister of leader Kim Jong Un, called the US claim "absurd rhetoric" and a "grave political provocation".

The denial comes three days after the FBI named North Korea's TraderTraitor group as the culprit, and it changes nothing about the on-chain evidence investigators have already published. It does, however, add a political layer to the biggest crypto theft on record as Binance continues to restore funds and reopen withdrawals.

Key takeaways

• Kim Yo Jong rejected the FBI's attribution of the Binance hack in a KCNA press statement released on November 2.
• She also denied North Korea's role in the $1.5 billion Bybit hack of February 2025.
• She suggested, without offering any evidence, that the US itself could benefit from the stolen crypto.
• The FBI, TRM Labs, Chainalysis and ZachXBT have all linked the Binance theft to North Korean hackers.
• BNB traded around $699 on OKX, down about 1.9% over 24 hours, with little visible reaction to the statement.

What North Korea said about the Binance hack

The statement was published under Kim Yo Jong's name as a department director of the ruling Workers' Party of Korea. She accused the FBI of trying to brand North Korea a "cyber criminal state" by claiming that a hacking group "supported" by Pyongyang was behind the Binance theft.

According to the KCNA text, she argued that this was not the first time Washington had "blindly" linked North Korea to large cyber incidents, and pointed to the Bybit case from last year as another example. She said North Korea opposes malicious activity in cyberspace and accused the US of politicising cybersecurity to interfere in other countries' affairs.

The most pointed part of the statement was a suggestion about who stands to gain. She noted that the current US administration had said it would confiscate stolen crypto and hold it as a strategic reserve, and said that looking at who would receive the funds if they were recovered "may" give a clue about who was behind the attack. The statement gave no evidence for that claim. She closed by saying Pyongyang was "closely monitoring" US actions and had "issues to reconsider" over Washington's stance.

South Korea's Yonhap news agency described the statement as a flat dismissal of the US investigation.

What the FBI and investigators found

The FBI said on October 31 that North Korea was responsible for the theft of more than $6 billion in digital assets from Binance on or about October 29. It attributes the attack to TraderTraitor, the name it uses for a North Korean cyber unit it has tied to several large exchange thefts. You can read our earlier report on the FBI's attribution of the Binance hack.

The bureau, working with the US Secret Service and the IRS criminal investigations unit, said the attackers were converting stolen assets mainly into ether (ETH) ahead of further laundering through DeFi apps and instant swap services. It published a list of wallet addresses and asked node operators, swap services, analytics firms and other crypto businesses to block transactions linked to them.

Private investigators reached the same conclusion independently:

• TRM Labs attributed the attack to TraderTraitor with high confidence, citing advance preparation, wallets funded through Tornado Cash (a crypto mixing tool) and the coordinated use of previously obtained transaction signatures.
• Chainalysis and on-chain sleuth ZachXBT also linked the theft to North Korean hackers.
• ZachXBT reported that funds from the Binance hack and the earlier Bitget breach were mixed at the same address after passing through THORChain, a cross-chain swap network.

TRM noted one difference from past cases: the laundering pattern after the Binance hack has not matched the one seen after Bybit.

Why the denial matters for crypto markets

North Korea routinely denies involvement in crypto thefts, so the statement was widely expected. Its practical impact on the investigation is limited, because attribution rests on blockchain data and intelligence rather than on any admission.

What it does signal is that recovering the funds will not come through cooperation with Pyongyang. That puts the weight on exchanges, stablecoin issuers and cross-chain services freezing flagged wallets before the coins are cashed out. Investigators have reported that the hackers are spinning up new wallets at high speed and moving funds through networks such as Tron and THORChain, so every hour matters for freezes.

For Binance itself, the focus remains on making customers whole. The exchange has said it has replenished most of the stolen funds and has published new proof-of-reserves data showing its top assets backed one to one, after drawing on about half of the Bitcoin in its SAFU emergency fund. Our report on Binance's SAFU fund and reserve proof covers those numbers in detail.

Market reaction: BNB and Bitcoin prices

Prices barely moved on the news. The wider market was already soft, with Bitcoin and most large coins slightly lower over the past day. OKX prices at the time of writing:

• BNB (BNB): about $699.35, down 1.9% in 24 hours
• Bitcoin (BTC): about $76,834, down 1.9%
• Ether (ETH): about $2,254, down 1.0%
• Tron (TRX): about $0.3195, up 2.0%

You can track these moves live on the Nodora charts page.

What to watch next

• Any US response: whether the FBI or other agencies answer the KCNA statement or add more addresses to their blocklist.
• Fund movements: large transfers from wallets flagged by the FBI and TRM, especially into Tron, THORChain or over-the-counter desks.
• Freezes and seizures: any stablecoin issuer or exchange freezing stolen funds, which would be the clearest sign of recovery.
• Binance's recovery: progress on restoring the remaining hacked funds and reopening all withdrawal networks.

This article is for information only and is not financial advice.

#Binance #North Korea #Hack #FBI #Bitcoin

This article is general information, not financial advice.