North Korea denies the FBI’s attribution of the Binance theft

North Korea has rejected the FBI’s finding that it was behind the theft of more than $6 billion from Binance. Kim Yo Jong, a senior Workers’ Party official, called the US claim absurd rhetoric. The denial does not change the FBI’s position.

Kim released the statement on 2 November. The Korean Central News Agency carried it on 3 November. She said Washington was again trying to brand the DPRK a cyber-criminal state, and she described the attribution as a grave political provocation. She also pointed to the US plan to hold seized cryptocurrency as a strategic reserve and suggested that whoever would receive recovered coins might be a clue to who was behind the hack. The statement offered no evidence for that suggestion.

The FBI alert still stands

On 31 October the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October, and it named the activity TraderTraitor. The bureau said it had seen the actors converting stolen assets primarily into ether and expected further laundering through decentralised-finance and instant-swap services.

The same alert publishes blockchain addresses and asks exchanges, DeFi services, analytics firms, node operators and other virtual-asset businesses to block transactions with those addresses or with funds derived from them. The FBI, the US Secret Service and IRS Criminal Investigation issued the request together.

TraderTraitor is an existing US law-enforcement label. In February 2025 the FBI used it for the theft of about $1.5 billion from Bybit, which it also attributed to North Korea. Kim’s statement said Washington had tried to blame the DPRK for that hack as well.

Binance has put its own loss estimate at about $6.3 billion and has said it will cover the financial impact rather than pass it on to users. That is the exchange’s commitment about its own incident. It is not a finding that the stolen coins have been seized, and it is not a guarantee for funds held at any other exchange.

What changes for players

The theft did not start at an online casino. It can still matter to players who leave cryptocurrency on a centralised exchange between a casino deposit and a withdrawal. A freeze at the exchange can block access even when the casino account itself is untouched.

The practical steps are narrow. Keep transaction IDs and withdrawal records. Check whether the particular network is open before moving funds. And do not treat an exchange balance as the same thing as coins in a wallet you control. Pyongyang’s denial is a political response to the FBI. It does not erase the alert or the request that services block the listed addresses.