This is a new development in a story we reported earlier: FBI, Secret Service and IRS attribute $6.43 billion Binance heist to TraderTraitor. Earlier in this story: Binance reports $6.3 billion crypto breach, suspends deposits and withdrawals.
Key facts
- Kim Yo Jong said the US is trying to damage Pyongyang's public image with the accusations.
- Kim Yo Jong called the allegations a grave political provocation and said the US misleads world opinion by blaming North Korea for cyber crimes everywhere.
- The FBI, Secret Service and cyber analysts said North Korea was behind the Binance hack.
- The FBI and blockchain analysts said state-backed hacking group TraderTraitor led the Binance attack.
North Korea has denied responsibility for the $6.3 billion Binance hack that occurred on or around October 29, in a new development after the FBI and Secret Service attributed the theft to the state-backed group TraderTraitor.
The FBI, Secret Service and cyber analysts said the state-backed hacking group TraderTraitor led the attack, and the FBI identified the Binance operation as linked to the group.
Kim Yo Jong said the US has made a trite provocation of linking it with the Democratic People’s Republic of Korea again, called the allegations absurd rhetoric and a grave political provocation, said the United States misleads world opinion by blaming Pyongyang for cyber crimes everywhere, added that the US is trying to damage Pyongyang’s public image with the accusations, and stated that North Korea opposes all sorts of malicious acts in cyberspace as a matter of consistent policy.
TraderTraitor is a subunit of the Lazarus Group, a state-backed hacking collective that has been blamed for previous major crypto thefts, and the S Rajaratnam School of International Studies says North Korea’s intelligence agency oversees hacker units filled with university students. North Korea has consistently denied claims of responsibility for major cyber attacks, but Pyongyang has been blamed for such attacks in recent years. Observers have called the Binance hack the largest ever recorded.
In 2025, the Lazarus Group, also called TraderTraitor, was blamed for a then-record $1.5 billion hack of the Bybit crypto exchange, and US authorities and cybersecurity experts also blame North Korean hackers for a 2022 theft of about $620 million from a crypto platform. Between 2016 and early 2026, North Korea-linked actors stole about $6.75 billion in 263 incidents, CertiK estimates, and the firm says crypto theft has become a core source of state revenue for North Korea.
According to CertiK, groups tied to North Korea took more than $2 billion out of $3.4 billion in total crypto losses in 2025, and Cointelegraph said hackers received about 60% of that value. The proceeds help finance nuclear and ballistic missile programs, and MilitarySpend puts the country’s annual defense budget at up to $6 billion, with weapons programs receiving off-budget financing from crypto theft. According to TRM Labs, attackers withdrew about $6.36 billion from Binance hot wallets on ten blockchains on October 29.
Initial checks showed that an attacker used a compromised engineer’s laptop to make unauthorized withdrawals, Binance said last week. Binance did not answer questions from the BBC about the alleged involvement of North Korea in the hack. The exchange worked with issuers to freeze affected assets, and trading in major cryptocurrencies on Binance has resumed. Binance said it would cover all losses linked to the attack, and the company has covered around 95% of the stolen assets.
About 90% of the stolen assets have been replaced, and Binance remains committed to covering the rest. A Binance spokesperson said since transactions resumed on Sunday, a net $4.72bn has left Binance. Binance’s total assets stand at approximately $157bn, making the outflow a small part of that total. Binance has begun restoring withdrawals across several networks.
Binance’s latest Proof of Reserves verification covered ten major crypto assets, letting users confirm balances backed at least 1:1 as of October 31. The hackers are converting stolen assets primarily into Ethereum. Many Binance proceeds have been laundered through TRON by rapidly transferring funds between addresses and repeatedly cycling them, while other laundering methods include cross-chain bridges and DeFi swaps, and mixers see little usage. Chainalysis reported that automated mechanisms shift funds across addresses to obscure the transaction trail.
Blockchain analytics firms have followed the assets across more than 40,000 transactions and 12,000 wallets on 11 blockchains. Chainalysis says thousands of addresses have already been used by the attackers and expects tens of thousands more in the coming weeks. The FBI expects hackers to launder funds via decentralized finance platforms and instant-swap services. The FBI and other agencies have asked private companies to help block transactions linked to TraderTraitor.
The FBI and other agencies have asked private companies to help block transactions linked to TraderTraitor. Blocking targets include over 600 Ethereum addresses, nearly 20 Bitcoin addresses and a single Solana address, and stablecoin issuers have frozen more than $2.4 billion of the stolen funds.
The US Secret Service is investigating the hack with the FBI. IRS Criminal Investigation and Justice Department officials are also involved. Investigators are trying to identify the stolen assets and freeze them.
To verify its suspicions, the FBI is examining blockchain links connected to previous hacks such as the $1.5 billion Bybit attack. Blockchain trails show widespread laundering but do not show who was ultimately directing the hack. Investigators require more evidence to identify specifically which addresses each person controlled, with possible data sources including malware samples, server logs, IP addresses and exchange records. Without independent forensic evidence and international cooperation, proving direct state involvement remains difficult.
The FBI and other agencies are working to identify and freeze stolen assets. President Donald Trump was asked about the hack on Saturday and said his administration would talk to North Korea about it, adding that they are learning about it. North Korea faces accusations of using cyber crime to fund its sanctioned economy, and this Binance hack is the latest case linked to it. Binance has not publicly identified the perpetrators and continues to investigate how attackers compromised its infrastructure.
Join the discussion