SEOUL, November 3, 2026 — North Korea has denied involvement in the $6.3 billion Binance hack, rejecting the FBI’s attribution of the theft to a hacking group linked to the country. The denial comes as the cryptocurrency exchange continues its recovery effort and customers have withdrawn billions of dollars in digital assets following the incident.
Kim Yo Jong, a senior North Korean official, described the FBI’s statement as a “trite provocation” and “absurd rhetoric,” according to The Associated Press. The FBI has attributed the attack to TraderTraitor, a group it links to North Korea. The competing statements leave attribution disputed in public, even as investigators and blockchain-analysis firms continue tracing the stolen assets.
Reuters reported that customers withdrew about $4.72 billion from Binance over several days after withdrawals began returning in phases. The Financial Times reported a net outflow estimate of about $4.9 billion in a separate snapshot. The figures use different reporting windows and should not be combined into a single total. Binance has said it has covered roughly 95% of the amount affected by the incident through replacement assets and reserves, while acknowledging that some less-liquid tokens remain to be sourced.
In a November 2 recovery update, Binance said it had generated the zero-knowledge proof for its October 31 proof-of-reserves snapshot, allowing users holding ten listed tokens to verify at least 1:1 backing. The company said the remaining 5% of affected assets were mainly lower-liquidity tokens outside the top ten. It also said another reserve snapshot was planned for November 4 and that a further withdrawal phase for additional networks and assets was planned for November 3. The figures and timetable remain Binance disclosures; they do not independently establish the cause of the original intrusion.
The incident occurred on October 29, when unauthorised transactions moved assets from Binance wallet infrastructure. Blockchain-intelligence firm TRM Labs estimated that about $6.36 billion moved across ten blockchains, with much of the activity concentrated in a short period. That estimate describes on-chain movements identified by the firm; it is not a final court finding or a complete independent accounting of customer losses.
Binance initially said its investigation pointed to a compromised laptop belonging to a DevOps engineer, which may have enabled an attacker to access a service container and submit unauthorised withdrawal transactions. The exchange later said it had identified additional points of breach. That means the laptop explanation should be treated as an early lead rather than a complete account of the attack. Binance has said it will publish a fuller technical post-mortem after the investigation is finished.
The company said it had engaged law-enforcement agencies and blockchain partners to trace and freeze assets. Its earlier updates put the amount frozen on-chain at roughly $3 billion. Such freezes can prevent some funds from being moved or exchanged through cooperating platforms, but they do not necessarily mean the assets have been returned to the original wallets or that all remaining funds can be recovered.
The FBI has attributed the theft to TraderTraitor, a name used for North Korea-linked cyber operations. TRM Labs also said it had high confidence in the group’s involvement, citing patterns it associates with earlier activity. Those assessments are important evidence, but a public attribution by a government agency or a private intelligence firm is not the same as a criminal conviction. The full technical evidence may not be disclosed while investigators pursue the case.
North Korea’s denial does not resolve the technical questions, just as the FBI’s attribution does not by itself disclose every step of the intrusion. A complete account would need to explain how the attackers gained access, which controls failed, how withdrawals were authorised, and how funds moved through wallets and exchanges afterward. The public record reviewed for this article does not provide a complete forensic reconstruction.
Also read: Binance Says $6.3 Billion Affected in Security Incident
North Korea has repeatedly been accused by governments and cybersecurity researchers of using hacking operations to generate revenue, steal cryptocurrency and obtain access to sensitive systems. Those accusations have become part of a wider debate about the role of cybercrime in state activity. But each incident still needs to be assessed on its own evidence. A country’s past record can inform an investigation; it cannot substitute for technical proof about a specific operation.
Kim Yo Jong’s response is a political denial, not a technical explanation of the wallet movements. It does not address the reported attack path, the compromised service or the flow of funds. Equally, the denial should not be ignored simply because US authorities have made an attribution. Independent investigators, law-enforcement agencies and courts may evaluate different parts of the evidence, and some details may remain unavailable to the public for operational reasons.
The distinction between a state-linked hacking group and a government order is also important. Researchers may identify tools, infrastructure, timing and operational patterns associated with a known group. That can support an assessment of who carried out an operation, but the chain of command, the degree of state direction and the purpose of a particular theft may require separate evidence. Public statements often compress those distinctions into a single label, even when the underlying confidence varies across parts of the assessment.
The denial is unlikely to end the investigation. Exchanges, blockchain analytics firms and law-enforcement agencies can continue tracing transactions regardless of whether a government accepts the attribution. The most useful evidence will be concrete: wallet addresses, transaction paths, records from platforms that received assets, technical logs and any court filings that describe how investigators connected the activity to specific operators.
The scale of withdrawals shows how quickly confidence can be tested after a major security incident. Reuters reported net outflows of about $4.72 billion, while the Financial Times reported roughly $4.9 billion in a separate estimate. Both indicate that customers moved large sums away from the exchange, but the figures should be read as snapshots rather than a permanent measure of losses or a count of customers who closed their accounts.
Binance has said outflows were stabilising and that about $2.7 billion in net inflows had returned since Sunday. That is the company’s own account of recent flows. It does not mean that every customer is satisfied, that all services have returned to normal or that the security investigation is complete. Flows can change quickly as customers respond to service notices, market conditions and new disclosures.
Withdrawals were restored in phases after the exchange temporarily paused the service while it reviewed the withdrawal system and related addresses. A staged restoration can help an operator test controls and monitor for suspicious activity before reopening every route. It can also leave customers uncertain about when their assets will become available, particularly when different networks and tokens require separate technical checks.
The exchange has said it will cover the financial impact and has published updated proof-of-reserves information for ten major cryptocurrencies. Binance says the listed customer balances are backed at a minimum one-to-one ratio in the snapshot and that the company has replaced or covered about 95% of the affected amount. Those are material disclosures, but the scope matters: the snapshot covers selected assets and balances at a stated time, not every liability or every future obligation.
Proof of reserves is not the same as a full audit of an exchange. A snapshot can help users verify that certain on-chain assets exist and are associated with customer balances, but it does not by itself show every liability, contingent claim, operational control or off-chain obligation. Nor does it establish that a withdrawal system cannot be compromised. Reserve transparency and cybersecurity are related but distinct questions.
Also read: Binance Publishes Proof-of-Reserves Data, Says 95% of Hack Amount Covered
Centralised exchanges must manage a difficult balance between speed and protection. Customers expect deposits and withdrawals to be available quickly, while exchanges need safeguards around hot wallets, internal services, employee devices and the software that authorises transactions. A compromise does not have to expose a private key directly to cause damage; an attacker who can manipulate a service that submits transactions may still be able to move assets if approval controls are inadequate.
Good controls include separating the systems used for development and production, limiting which accounts can initiate withdrawals, requiring additional approval for unusual transactions and monitoring for deviations from normal behaviour. Sensitive credentials should be protected from employee-device compromise, and access should be removed when it is no longer required. High-value operations can also be subject to limits, delays or independent review, although such measures must be designed carefully so they do not create a different single point of failure.
Incident response is as important as prevention. An exchange needs a reliable way to stop suspicious activity, preserve logs, notify relevant authorities, coordinate with other platforms and communicate clearly with customers. It must also be able to restore services without reintroducing the vulnerability that caused the incident. A detailed post-mortem should explain the failure path, the controls that were changed and how those changes were tested.
Customers should be cautious about messages promising special compensation, faster withdrawals or help recovering stolen assets. Major crypto incidents attract impersonation attempts because users are worried and may be willing to act quickly. A request for a seed phrase, private key, password or payment to unlock funds should be treated as a serious warning sign. Users should rely on verified exchange communications and avoid giving account credentials to unsolicited contacts.
The wider industry also faces a trust problem. Crypto platforms often operate across borders, while the customers, wallets, liquidity providers and law-enforcement agencies involved in a theft may be in different jurisdictions. Coordination can help freeze assets, but recovery is complicated when stolen tokens pass through multiple services, decentralised exchanges or bridges. The fact that an asset can be traced on a public blockchain does not guarantee that it can be recovered.
For regulators and institutional customers, the incident reinforces the need to assess both financial backing and operational security. A platform may hold sufficient assets to cover a loss while still having weaknesses in the systems that control withdrawals. Conversely, a security incident does not by itself prove that every customer balance is unbacked. Risk assessment requires separate evidence about custody, reserves, liabilities, access controls and recovery procedures.
The next important developments are a fuller technical post-mortem from Binance, additional disclosures about the remaining affected tokens, and any new evidence released by investigators. Further information from blockchain-analysis firms may refine the amount traced, frozen or moved through other services. Those figures can change as analysts identify more addresses and distinguish between assets that were stolen, immobilised or replaced by the exchange.
Customers will also watch whether withdrawals remain reliable across different tokens and networks, whether the exchange publishes further reserve data and whether the company explains how it has addressed the additional breach points it said it found. A service returning to normal is one milestone; demonstrating that the underlying weakness has been corrected is another. The latter requires evidence about testing and controls, not only a statement that operations have resumed.
The political dispute over attribution may continue separately from the technical investigation. North Korea’s denial is clear, but the public evidence will be judged by its detail and corroboration. For now, the FBI and TRM Labs have linked the operation to TraderTraitor, while the North Korean statement rejects that account. The available material does not justify treating the disagreement as settled by rhetoric from either side.
The Binance hack has become both a test of the exchange’s recovery process and a case study in the difficulty of attributing large cryptocurrency thefts. The outflows show the commercial cost of uncertainty, while the reserve disclosures offer only a partial answer to questions about customer protection. The most useful next step is not another broad assurance, but a verifiable technical account that explains how the intrusion occurred, what was changed and how the remaining risks are being measured.