North Korea Denies $6.3 Billion Binance Hack
2 min read
Key Takeaways
- The FBI identified the attackers as TraderTraitor in an October 31 advisory.
- Chainalysis connected part of the stolen assets to infrastructure associated with September’s Bitget exploit.
- Asset issuers froze approximately $3 billion in affected digital assets.
North Korea denied involvement in the $6.3 billion Binance hack on November 2, 2026, rejecting FBI accusations in a statement carried by KCNA and reported by The Defiant.
Binance said customer deposits were unaffected and approximately 95% of stolen funds had been replaced using corporate treasury resources and insurance funds. Withdrawals were being restored in phases.
Kim Yo Jong, a department director of the Workers’ Party of Korea Central Committee, dismissed Washington’s accusations as “an absurd rhetoric and nothing new”. She described the attribution as a “grave political provocation” and maintained that Pyongyang opposed malicious activity in cyberspace.
Blockchain Evidence Challenges North Korea’s Denial
According to the FBI’s October 31 cyber alert, state-sponsored attackers carried out the breach on October 29, 2026, converting stolen assets primarily into Ether.
Blockchain analytics firm Chainalysis expressed a “high degree of confidence” in North Korean responsibility, citing transactions connecting Binance assets with proceeds of the earlier Bitget attack.
TRM Labs estimated the stolen assets at approximately $6.36 billion across ten blockchains, making the scale of the breach central to the investigation.
Binance Recovery and Next Steps
Asset issuers and blockchain partners, including Tether and Circle, coordinated restrictions on compromised tokens. Frozen assets remain distinct from funds already reimbursed to customers.
Binance scheduled further withdrawal restoration across supported blockchain networks for November 3, 2026, while federal investigators urged digital asset service providers to block transactions involving identified attacker-controlled addresses.
