North Korea Denies Involvement in Massive $6.3 Billion Binance Crypto Heist

North Korea has officially denied allegations that its state-sponsored hackers orchestrated the $6.3 billion theft from the cryptocurrency exchange Binance on October 29, 2026. While the FBI and other security agencies blame a North Korean group, Pyongyang has dismissed the claims as a political attempt to damage its reputation.
- The FBI identified the North Korean-linked group TraderTraitor as the party responsible for the heist, according to NBC News.
- Binance reported on Sunday that customers withdrew more than $3.6 billion in assets as the exchange reopened following the breach, per the BBC.
- The exchange has already replaced 90% of the stolen funds using company reserves, according to a statement from co-CEO Richard Teng shared via NBC News.
Who is being blamed for the theft?
The FBI and several cyber analysts have attributed the massive breach to TraderTraitor, a hacking unit linked to North Korea. This group is considered an arm of the Lazarus Group, which operates under North Korean military intelligence, according to NPR.
Law enforcement officials observed the attackers converting stolen assets into ethereum to move the funds, as reported by NBC News. The FBI has urged industry partners to block transactions involving specific wallet addresses linked to this group to prevent further laundering.
How does North Korea respond to the claims?
North Korean officials have rejected the accusations, calling them a "grave political provocation." They argue that the United States is using these allegations to mislead international public opinion and paint the country as a criminal state.
Kim Yo-jong, Director of North Korea's General Affairs Department, via the BBC: "It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds."
Kim Yo-jong, the sister of leader Kim Jong Un, also suggested that the U.S. government might have its own motives for these claims. According to the Business Insider, she noted that the Trump administration's plans to use confiscated cryptocurrency as a strategic reserve could provide a clue regarding the true identity of the hackers.
How did the hackers gain access to Binance?
The breach was a highly complex operation that targeted the internal infrastructure of the exchange. Initial investigations by Binance suggested that a DevOps engineer's laptop was compromised, which allowed the attackers to bypass security and execute unauthorized withdrawals, according to the Business Insider.
The attackers used malicious software specifically designed to delete evidence of their activity, making the investigation difficult. While Binance stated that there was no evidence that wallet private keys were leaked, the hackers successfully bypassed other layers of security to facilitate the massive outflow of funds.
Is the stolen money being recovered?
The crypto industry has worked to freeze a portion of the stolen assets. Ari Redbord, head of global policy at TRM Labs, told NPR that crypto firms managed to freeze more than 40% of the stolen funds before they could be cashed out.
Despite this, experts warn that the remaining funds are still at risk. The FBI expects "further laundering" to occur through various technologies. The attackers are actively attempting to move the remaining assets through different blockchain networks and decentralized finance services to hide their final destination, as noted by CBC News.
How is Binance protecting its users?
Binance is using its own internal funds to ensure customers do not suffer financial losses. The company has set aside approximately $6.34 billion to cover the impact of the attack, according to NBC News.
To replenish the stolen assets, Binance utilized several sources of capital:
- The $1 billion Secure Asset Fund for Users (SAFU).
- The company's Futures Insurance Fund.
- Binance's own corporate treasury.
Why does North Korea conduct cyber attacks?
Cyber operations have become a primary source of income for the North Korean state. A United Nations Security Council report cited by NPR indicates that cyber theft now provides roughly 50% of North Korea's foreign currency earnings.
These funds are used to bypass international sanctions and finance the country's nuclear and weapons of mass destruction programs. South Korean intelligence estimates that North Korea maintained over 8,400 trained cyber warfare agents as of 2024, with many being recruited from universities at a very young age to serve in elite intelligence units.
What happens next?
The investigation into the movement of the stolen ethereum and other assets continues. Law enforcement agencies and blockchain analysts are monitoring wallet addresses to intercept any further laundering attempts. Binance is also performing a new "proof-of-reserves" snapshot to verify that all user assets, including the 10 major tokens like BTC and ETH, are backed at a 1-to-1 ratio.
Frequently Asked Questions
How much money was stolen from Binance?
The hack resulted in the theft of approximately $6.3 billion in cryptocurrency, making it the largest hack in history, according to the BBC.
Did North Korea admit to the hack?
No, North Korea has officially denied all involvement, calling the FBI's accusations "absurd rhetoric" and a political provocation, according to the BBC.
Will Binance users lose their money?
Binance co-CEO Richard Teng stated that the company is committed to covering all losses so that users do not bear the financial impact, according to NBC News.
Sources
- 1.bbc.co.ukNorth Korea denies being behind record $6.3bn Binance hack
- 2.nbcnews.comFBI says North Korea was behind the $6.3 billion Binance crypto hack
- 3.businessinsider.comNorth Korea says it wasn’t behind the $6.3 billion Binance hack and claims the US blames it for “all the cyber crimes”
- 4.npr.orgFBI says North Korean hackers are behind the theft of $6.3B from Binance
- 5.cbci.co.kr바이낸스 63억 달러 해킹, FBI 북한 배후 지목…이더리움 자금 이동 추적


