Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed US claims linking the country to the Binance hack as “absurd rhetoric,” Reuters reported on Nov. 2, citing the Korean Central News Agency, or KCNA. The denial disputes the US government’s attribution of the theft of more than $6 billion from the cryptocurrency exchange.
The FBI had blamed North Korea’s TraderTraitor operation in an Oct. 31 alert, placing the theft on or about Oct. 29. TraderTraitor is the bureau’s name for the specific North Korean cyber activity it identified in the attack.
FBI blames North Korea for $6 billion Binance hack, urges THORChain to block stolen funds
Blockchain intelligence firm TRM Labs estimated that approximately $6 billion left Binance wallets across ten blockchains, with most of the funds moving in about 20 minutes beginning at 20:05 UTC on Oct. 29. The firm’s initial figures reflected observations through 00:30 UTC on Oct. 30.
TRM attributed the Binance hack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence.
The firm also assessed that valid signed transfers across different blockchains pointed to a compromise of Binance’s hot-wallet signing infrastructure. That would place the breach in the systems used to authorize outgoing wallet transactions. The explanation remains TRM’s assessment of how the transfers were enabled. Its conclusion connects the ability to produce valid transfers on different networks with a potential weakness in the infrastructure used to sign those transactions.
Know what’s moving crypto.
Competing statements concern the same Binance theft; agencies request transaction blockingFBI · 31 OCT 2026Attributes theft toNorth Korea / TraderTraitorNORTH KOREADisputes FBI attributionLink is “fabrication”Reuters citing KCNA · 2 NovATTRIBUTESSAME INCIDENT · BINANCEMore than $6bnFBI: theft on or about 29 Oct 2026FBI + USSS + IRS-CI · REQUESTBlock linked transactionsListed addresses and funds derived from themConnectors show statements and requested action.FBI attribution and reported North Korean denial address the same theftFBI · 31 OCT 2026Attributes theft toNorth Korea / TraderTraitorNORTH KOREADisputes FBI attributionLink is “fabrication”Reuters citing KCNA · 2 NovSAME INCIDENT · BINANCEMore than $6bnFBI: on or about 29 Oct 2026FBI + USSS + IRS-CI · REQUESTBlock linked transactionsListed addresses and fundsderived from themStatements and requested action
What the FBI observed and expected
What the FBI observed and expectedObserved conversionExpected next step
The FBI said investigators had observed stolen assets being converted primarily into ether.
OBSERVED CONVERSIONFBI ALERT · 31 OCT 2026 · OBSERVED CONVERSIONStolen assetsPrimarily etherConversion observedOBSERVED CONVERSIONFBI ALERT · 31 OCT 2026 · OBSERVEDStolen assetsPrimarily etherConversion observed
The FBI expected further laundering through DeFi and instant-swap services.
EXPECTED NEXT STEPFBI ALERT · 31 OCT 2026 · EXPECTED NEXT STEPStolen assetsDeFi + instant swapsFurther laundering expectedEXPECTED NEXT STEPFBI ALERT · 31 OCT 2026 · EXPECTEDStolen assetsDeFi + instant swapsFurther laundering expected
The blocking appeal covers listed addresses and funds moved onward from them.
The FBI attributed responsibility; North Korea disputed the attribution in a denial reported by Reuters citing KCNA. Blocking was requested, not confirmed as implemented. Expected laundering is a forecast in the October 31 alert.
Binance uncovers more breach points in $6 billion hack
FBI seeks to block transactions linked to the Binance hack
The FBI said investigators working with the US Secret Service and IRS Criminal Investigation had observed the actors converting stolen assets primarily into ether. The bureau expected further laundering through decentralized finance, or DeFi, and instant-swap services.
Binance hackers deploy never-seen-before laundering tactics to conceal $6.3 billion theft
The alert urged cryptocurrency service providers to block transactions involving the listed theft-linked addresses. It described those wallets as operated by, or closely connected to, TraderTraitor actors. CryptoSlate reported the FBI attribution and blocking appeal on Nov. 1, before the North Korean denial.
The request extends beyond exchanges to blockchain infrastructure operators, DeFi services and analytics firms. The FBI specifically named THORNode operators, RPC node operators and instant exchanges, alongside decentralized services and other businesses that handle virtual assets. It covers transactions involving both the identified addresses and funds derived from them.
