North Korea has rejected allegations from US authorities connecting the nation to an October 29 crypto theft at Binance, calling the claims absurd rhetoric. Pyongyang called the accusations a grave political provocation designed to tarnish its international public image.
Key Facts
- The October 29 hack resulted in an estimated $6.3 billion loss at Binance.
- The FBI attributed the attack to the North Korean group TraderTraitor.
- North Korea dismissed the accusations as absurd rhetoric and a political provocation.
- Binance reported covering roughly 95 percent of the impacted funds using company reserves.
Kim Yo-jong, a high-ranking official and sister of leader Kim Jong Un, issued a statement on Tuesday dismissing the claims as absurd rhetoric and a sinister attempt by the United States to manufacture false narratives. According to the BBC, the official argued that Washington routinely blames the Democratic People's Republic of Korea for global cyber offenses. The US Federal Bureau of Investigation, together with the Secret Service and IRS Criminal Investigation, officially pinned the October 29 incident on the state-sponsored hacking collective known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38, as reported by BleepingComputer. SecurityWeek noted that the intrusion emptied hot wallets across multiple blockchains within roughly twenty minutes, making it the largest digital currency heist in history. Blockchain analytics firms such as TRM Labs and Chainalysis quickly connected the cyberattack to the North Korean unit.
Binance co-CEO Richard Teng explained that the operation extended far beyond a single compromised laptop, involving a complex breach that deployed a self-destruct mechanism to erase tooling and evidence. The exchange stated that the attacker leveraged Ethereum protocol features that bypassed standard approval controls. Following the breach, federal agencies released a detailed security alert containing hundreds of crypto addresses holding stolen assets, urging decentralized finance platforms, node operators, and instant exchanges to block related transactions. SecurityWeek reported that the Federal Bureau of Investigation flagged 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address linked to the laundering operation.
Analytics firms observed that the laundering process relies heavily on automated scripts or tools operating around the clock, converting stolen assets primarily into Ethereum before moving them through decentralized finance protocols and instant swap services like THORChain. Elliptic figures indicated that the attacker retained control over billions in unfreezable assets spread across hundreds of addresses. Despite the scale of the intrusion, Binance initiated a phased withdrawal recovery starting on November 1, restoring major balances while covering approximately 95 percent of the losses using corporate funds rather than passing the burden to users.
Background
TraderTraitor has a documented history of targeting digital currency platforms and financial institutions across the globe. Law enforcement agencies previously connected the same state-backed collective to major intrusions such as the $1.5 billion Bybit heist in February 2025, the $387.5 million Bitget breach, and the DMM Bitcoin theft, which often involved social engineering tactics like fake recruitment campaigns.
The October 29 Binance attack saw malicious actors exploit service containers after unauthorized access was achieved. While initial assessments pointed toward a developer laptop, subsequent internal reviews uncovered multiple entry vectors and complex automation scripts moving funds continuously across various blockchain bridges.
Why It Matters
This massive digital asset heist and the subsequent international attribution highlight the growing sophistication of state-sponsored cyber operations targeting financial infrastructure. The incident may prompt tighter security controls across cryptocurrency exchanges and increased regulatory pressure on decentralized finance liquidity routes.
Illustration: AI-generated image, not a photograph of the event.