North Korea has denied any role in the $6.3 billion Binance hack, rejecting the FBI's TraderTraitor attribution as "absurd rhetoric" in a statement from Kim Yo Jong, the influential sister of leader Kim Jong Un. The North Korea Binance hack denial, carried on Tuesday, November 3, 2026, by state news agency KCNA, is Pyongyang's first direct public response to the FBI advisory that blamed North Korean state-sponsored actors for the October 29 theft from the world's largest cryptocurrency exchange. Kim accused Washington of linking North Korea to cybercrimes whenever they occur internationally, and warned Pyongyang had "issues to reconsider" over a hostile American attitude.

Key Points

• Kim Yo Jong called the FBI's TraderTraitor attribution "absurd rhetoric and nothing new" and "a trite provocation".
• The FBI said on October 31 that North Korean state-sponsored actors orchestrated the theft of more than $6 billion from Binance.
• Blockchain firm Elliptic said its analysis supports the FBI attribution and that $2.85 billion has been frozen or seized.
• Elliptic found automated laundering but no proof that AI agents directed the transactions.
• The denial follows the FBI attribution and Binance's phased reopening of withdrawals after the October 29 hack.

What Happened

Kim Yo Jong issued the denial in a statement carried by KCNA on Tuesday, November 3, days after the FBI published an advisory on October 31 naming TraderTraitor, a cluster of North Korean state-sponsored activity linked to the Lazarus Group, as the orchestrator of the Binance theft. The FBI identified wallet addresses connected to the heist and urged exchanges to block them. The theft took place on October 29, when more than $6 billion, estimated at about $6.3 billion to $6.4 billion, was taken from Binance in what is regarded as the largest cryptocurrency theft ever reported, dwarfing the $1.5 billion Bybit hack attributed to North Korea in February 2025.

Kim's statement did not address the wallet addresses, the transaction trail, or the technical evidence cited by the FBI and blockchain analysts. Instead, it attacked the attribution itself, describing the claim as "absurd rhetoric and nothing new" and "a trite provocation", and in a stronger formulation carried in some reports, "a grave political provocation". She accused Washington of reflexively blaming North Korea whenever a major cybercrime occurs anywhere in the world.

Background and Context

The Binance hack of October 29 stunned the cryptocurrency industry by its scale. Within hours, stablecoin issuers and exchanges moved to freeze funds, and Binance said it would cover customer losses. Early estimates put the theft at more than $5.7 billion, before later assessments raised it above $6 billion. By the following days, roughly $3 billion had been frozen on-chain, including large tranches of Tether and Circle stablecoins. Binance later reopened services in phases, with a second withdrawal phase opening on November 3.

The FBI's October 31 advisory placed the theft in a well-documented pattern. The Lazarus Group has been blamed by the United States, South Korea and the United Nations for a long series of cryptocurrency thefts, bank heists and ransomware operations over more than a decade. The February 2025 Bybit hack, worth about $1.5 billion, was the previous record, and investigators said the Binance theft was roughly four times larger. Elliptic said its analysis supports the FBI attribution and that $2.85 billion has been frozen or seized.

North Korea Binance Hack Denial

The North Korea Binance hack denial follows a familiar Pyongyang script: a flat rejection, a counter-accusation against Washington, and a warning left deliberately vague. Kim Yo Jong, one of the regime's most prominent public voices on relations with the United States and South Korea, framed the FBI advisory not as a law-enforcement finding but as a political act. By calling it "absurd rhetoric", she sought to strip the attribution of authority before its evidence is publicly debated, and by calling it "nothing new", she presented it as another instalment in a long American campaign rather than a response to a specific crime.

The phrase "issues to reconsider" is the statement's most ambiguous element. Analysts will watch whether it foreshadows any change in Pyongyang's posture. What the denial does not do is engage with the forensic trail: the FBI's wallet identifications, the freezing actions by Tether, Circle and other firms, and Elliptic's tracing work remain unanswered in public by Pyongyang.

Reactions and Quotes

Kim Yo Jong said the FBI claim was "absurd rhetoric and nothing new" and described it as "a trite provocation". She also called it "a grave political provocation", according to reports of the KCNA statement, and accused Washington of linking North Korea to cybercrimes whenever they occur internationally. She said North Korea had "issues to reconsider" over the American hostile attitude.

The FBI, in its October 31 advisory, said North Korean state-sponsored actors under the name TraderTraitor orchestrated the theft, identified wallet addresses and urged exchanges to block them. Elliptic said its analysis supports the FBI attribution and that $2.85 billion has been frozen or seized. Binance has not, in the material reported so far, publicly responded to the denial itself, having previously said it would cover customer losses.

Why It Matters

The denial matters for three reasons. First, it sets up a direct clash of narratives over the largest cryptocurrency theft in history, with the FBI and private analysts on one side and Pyongyang on the other, and billions still unrecovered. Second, it tests attribution as a policy tool: if North Korea can dismiss a detailed FBI finding with a short statement and face no further consequence, the deterrent value of public attribution weakens. Third, it underlines how central cryptocurrency theft has become to North Korea's alleged sanctions-evasion strategy, with Western officials estimating past thefts channelled hundreds of millions of dollars towards its weapons programmes.

What Happens Next

Investigators will continue tracing the stolen funds and pressing exchanges to freeze wallets linked to the theft. North Korea's next public statement, if any, will be watched for whether the vague "issues to reconsider" warning hardens into a concrete step. For now, the attribution stands, the denial stands alongside it, and the money trail continues.

Frequently Asked Questions

What did North Korea deny? Kim Yo Jong denied North Korea was behind the October 29 Binance theft of more than $6 billion, calling the FBI's TraderTraitor attribution absurd.

What did the FBI say? On October 31, the FBI said North Korean state-sponsored actors under the name TraderTraitor, linked to the Lazarus Group, orchestrated the theft, and it identified wallet addresses for exchanges to block.

How much has been recovered? Elliptic said $2.85 billion has been frozen or seized, out of a total estimated at about $6.3 billion to $6.4 billion.

Is this the largest crypto theft ever? Yes, by value. It dwarfs the $1.5 billion Bybit hack of February 2025, also attributed to North Korea-linked actors.

What happens next? Tracing and freezing continue, Binance's service restoration continues in phases, and further official statements may add detail to the attribution or the denial.

Read more: Binance's second withdrawal phase opens on November 3 after the $6.3 billion hack and Binance hack drains $5.7 billion in the largest crypto heist ever reported.