Crypto

North Korea denies stealing $6 billion from Binance after the FBI blamed its hackers

Kim Jong Un's sister called the US accusation a political attack. Elliptic says the on-chain evidence supports the FBI's attribution to TraderTraitor.

By Jennifer Walsh · Nov 3, 2026, 9:50 AM EST

Why it matters: The FBI says stolen funds went mainly into ether and expects more DeFi laundering, and the FBI wants crypto firms to block the hackers' addresses.

For information only, not investment advice.

North Korea says it didn't steal the more than $6 billion taken from Binance last week. Kim Yo Jong, the sister of leader Kim Jong Un, called the US accusation a political attack in a statement published Tuesday by state news agency KCNA, CoinDesk reported.

“As regards this extra-large incident, the U.S. has made a trite provocation of linking it with the Democratic People's Republic of Korea again,” she said, according to CoinDesk. She also called the accusation “absurd rhetoric and nothing new.”

What the FBI says

In an Oct. 31 alert, the FBI said North Korea was responsible for the theft of more than $6 billion in crypto from Binance on or about Oct. 29. It calls the operation TraderTraitor, the same name it used for the Bybit hack in February 2025. Kim disputed that attribution too, CoinDesk reported.

The FBI, working with the Secret Service and IRS Criminal Investigation, said it has seen the hackers convert stolen assets mainly into ether ($ETH), and expects them to launder it further through DeFi and instant swap services. The agencies asked node operators, swap services, analytics firms and other crypto businesses to block transactions with or derived from the hackers' addresses. The alert lists over 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address, according to CoinDesk.

According to CoinDesk, the FBI hasn't publicly released its full forensic findings. Its alert names the wallets it says are controlled by or connected to North Korean hackers.

What the blockchain trackers see

Elliptic, a blockchain analytics firm, sided with the FBI. “The on-chain evidence links the $6.4 billion theft from Binance to the DPRK and Elliptic’s analysis supports the FBI’s attribution specifically to the North Korean state-linked group TraderTraitor,” the firm told CoinDesk. TRM Labs had attributed the estimated $6.36 billion theft to TraderTraitor before the FBI did, the Korea Herald reported.

Elliptic says $2.85 billion of the stolen funds has been frozen or seized. The Secret Service said it worked with crypto companies and the Justice Department within minutes of the attack to “identify and freeze a significant portion of stolen cryptocurrency,” The Record reported. Investigators are still tracking the rest: Elliptic counted about 12,000 wallets across 11 blockchains and about 40,000 transactions, with funds shuffled to a new wallet every 25 seconds. It found evidence that the laundering was automated but no proof that AI agents were directing it.

Vasily Vidmanov, COO and head of investigations at AMLBot, said the evidence has limits but adds up. “Onchain analysis can link wallets to one actor. It can’t prove nationality or state sponsorship,” he told CoinDesk. “The evidence supporting the DPRK attribution is cumulative and goes well beyond speculation.” He pointed to funds from the Binance hack and the Bitget hack sitting together in the same wallets, which investigators say connects the two attacks.

Why holders should care

The denial doesn't change where the money is going. The FBI says the hackers have converted it mainly into ether and expects them to launder it further through DeFi and swap services, and the FBI is asking the industry to block those transactions. How much more gets frozen depends on exchanges and protocols acting on that address list.

CoinDesk said it had asked the FBI, Binance and TRM Labs for comment on Kim's statement.

Tags: exchanges · ethereum · regulation