North Korea denied responsibility for the Binance cryptocurrency theft on November 3, 2026, after the FBI attributed the attack to North Korean activity it calls TraderTraitor. Associated Press reported that Kim Yo Jong, sister of leader Kim Jong Un, rejected the accusation as “absurd rhetoric.”
Chainalysis estimates that approximately $6.4 billion left Binance wallets, while the FBI describes the stolen amount as more than $6 billion. Those figures describe the original theft, rather than a current balance of unrecovered assets.
Pyongyang Rejects the Attribution
Kim framed the accusation as another attempt by Washington to associate North Korea with international cybercrime, according to AP. Her response directly challenges the FBI’s published assessment.
The bureau’s October 31 advisory identifies Binance as the victim and dates the theft to around October 29. It says North Korea was responsible and uses TraderTraitor to identify the malicious cyber activity involved.
The FBI, Secret Service and IRS Criminal Investigation urged crypto service providers to block transactions involving, or derived from, listed addresses. The request reaches beyond exchanges to DeFi services, node operators and blockchain analytics firms.
Investigators Point to Funds Mixing Across Attacks
Chainalysis published a separate attribution assessment on October 30. Its strongest reported link was stolen Binance funds mixing on-chain with assets from the previous month’s Bitget theft, which it had attributed to North Korean actors. That connection provides a concrete basis for its assessment by tracing stolen assets across the two incidents.
Chainalysis also described a race to convert assets before issuers could freeze them. It reported that the attacker exchanged $325 million in stablecoins for $285 million in ETH over nearly 20 minutes. The FBI separately said it had observed stolen assets being converted primarily into Ether and expected further laundering through DeFi and instant swap services.
Those conversions help explain the agencies’ focus on blocking transactions: interrupting the movement of funds requires action at the specific addresses and services used to move them.
Overview
North Korea has publicly rejected the FBI’s attribution of the Binance theft to TraderTraitor. Chainalysis estimates the original theft at approximately $6.4 billion and reports that stolen funds mixed with assets from the Bitget attack. US agencies have asked crypto service providers to block transfers involving or derived from the FBI’s listed addresses.
