Kim Yo Jong answered the FBI on Nov. 32. North Korea's leading spokesperson called the bureau's finding "a grave political provocation." She denied any hand in Binance's $6.3 billion theft. The FBI had named her country's hackers on Nov. 1, 2026. It pointed to a unit it calls TraderTraitor1. This denial is North Korea's fifth. TRM Labs and the FBI tie the same operator to four earlier thefts. Each one grew bigger than the last, stretching back to 2024. The pattern matters more than any single statement.
A Fifth Theft Fits an Old Shape
Binance's theft unfolded on Oct. 29, 20261. A compromised engineer's laptop opened the door. That gave an attacker a path into a service container that could submit withdrawal transactions. It drained wallets within about 20 minutes. The FBI's Nov. 1 alert named the group TraderTraitor. That is the same name it gave the $1.5 billion Bybit theft of February 2025. Four more thefts sit behind that one, each a step toward Binance's size. DMM Bitcoin lost $308 million in May 2024. Drift lost $280 million in April 2026. Bitget lost $387.5 million in September 2026, just weeks before Binance's turn came. Each theft grew the running total higher than the last. Binance's $6.3 billion dwarfs the four before it combined.
North Korea's Crypto Heists Grew From $308 Million to $6.3 Billion Since May 2024
Five thefts tied to North Korea's TraderTraitor unit, by the month each theft happened
- Binance: $6,300M
- Bybit, the prior record: $1,500M
- Three earlier thefts, each smaller than Bybit's
Source: BleepingComputer [1].
Read the chart as a table
| Item | Value | Note |
|---|---|---|
| DMM Bitcoin | $308M | May 2024 |
| Bybit | $1,500M | February 2025, the prior record for a single crypto theft |
| Drift | $280M | April 2026 |
| Bitget | $387.5M | September 2026 |
| Binance | $6,300M | October 2026, the theft this piece covers |
The FBI followed its alert with specifics. Agents flagged 628 wallet addresses tied to the theft. That count spans 608 on Ethereum, 19 on Bitcoin and one on Solana7. Investigators asked exchanges, wallet operators and blockchain analytics firms to block any transaction touching those addresses. Tether froze more than $1.5 billion in stolen USDT within 30 minutes. It matched its tokens against the FBI's list. Binance's co-chief executive, Richard Teng, made a pledge: the exchange will cover whatever its own recovery effort misses.
Both sides, in their own words
Does Pyongyang's denial of its biggest heist yet undercut the agency that named it?
“When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity. That makes this a global security issue, not just a crypto theft”
“It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds”
Pyongyang's Denial, Word for Word
North Korea rejected the finding in blunt terms. “It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong said. She called the FBI's attribution a "trite provocation"2. Her only official standing is as Kim Jong Un's sister. Those statements still carry Pyongyang's position abroad. Her denial repeats a script. North Korea denied the Bybit theft the same way in 2025. It denied the DMM Bitcoin theft before that.
Ari Redbord takes the opposite read. He is the global head of policy at TRM Labs. “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity. That makes this a global security issue, not just a crypto theft,” Redbord said4. Redbord spent the days after the theft walking reporters through the laundering chain his firm traces for a living. His sentence names the stakes a denial leaves standing: the money still moves somewhere.
Where the Blockchain's Proof Runs Out
Vasily Vidmanov treats the case differently. He is the chief operating officer and head of investigations at AMLBot, and he drew the line precisely. “Onchain analysis can link wallets to one actor. It can't prove nationality or state sponsorship,” Vidmanov said3. His caution names a real gap. A wallet's history names who controlled it. The government behind that person stays a separate question.
Vidmanov's own next point closes that gap differently than a courtroom would. “The evidence supporting the DPRK attribution is cumulative and goes well beyond speculation,” he said. He pointed investigators toward the laundering route itself. That route is the test that will answer North Korea's denial. “If it follows the same laundering route we've seen happen in earlier thefts attributed to North Korea, through swaps into bitcoin and then through OTC brokers, the laundering will answer the denial better than any statement,” he said3. Park Seong-su describes the group's method the same way. He is a staff threat researcher at the cybersecurity firm Zscaler. “This particular group looks for a big haul. They target crypto-related businesses, gain an understanding of their infrastructure and then tamper with it, or fund transfer processes, to execute a large-scale theft,” Park said5. A single wallet proves an actor. Five thefts sharing one playbook point past that actor. They point toward who trained it.
Nick Carlsen, an investigator at TRM Labs, flags a newer wrinkle in that playbook. “Novel techniques employed by TraderTraitor suggest the group is making ample use of AI in its recent hacks,” Carlsen said5. AI tools lower the skill a theft needs, and they speed up every step of one. Researchers call the group's approach "big game hunting": pick the richest target first, then build the exact access the theft requires. Binance's $6.3 billion take fits that description better than any prior theft on the list.
Share of 2026's reported crypto hack losses Chainalysis attributes to North Korea's hackers
- North Korea's hackers: 89
- Every other hacker combined: 11
Source: Taipei Times [5].
Read the chart as a table
| Item | Value |
|---|---|
| North Korea's hackers | 89 |
| Every other hacker combined | 11 |
| Whole | 100 |
The Money That Funds the Denial
Chainalysis puts a number on how far that playbook now reaches. The firm attributes 89% of this year's reported crypto hack losses to North Korea's hackers. That leaves 11% of the full 100% to every other hacker combined5. Sandra Ro reads that share as bigger than any single exchange's balance sheet. She is chief executive of the Global Blockchain Business Council. “These cyberattacks are not just a 'crypto' problem; these are a global financial markets and security problem,” Ro said6. Her sentence reframes the question. A 95% refund tells customers their balances are whole. It stays silent on where the other 5% lands, and on the stolen funds from four earlier thefts too.
UN sanctions investigators drew this link years ago. They tied North Korea's crypto theft to its weapons programs well before this year. The U.S. Treasury sanctioned North Korean-linked Binance wallets on those grounds in 2023, years before Binance itself became the target.
The FBI now draws the same through-line from 2024's DMM Bitcoin theft to 2026's Binance theft that Treasury drew in 2023. Stolen crypto gets laundered in stages. It reaches a state program that outlasts any exchange's recovery plan.
What Each Side Needs to Be True
North Korea's denial needs the laundering trail to end somewhere other than Pyongyang. Zero tracer has reported that result across five thefts running back to 2024. The FBI's case needs that trail to keep matching Vidmanov's route. Swaps into bitcoin, then over-the-counter brokers: the same two steps TRM Labs found behind Bybit and DMM Bitcoin. A denial that repeats five times carries less weight each time it fails to change the money's path. Readers can judge this apart from either side's word. The frozen funds, the wallets still being watched and the next theft's shape will say which one was right.
By the numbers
- $6.3 billion: stolen from Binance on Oct. 29, 2026, the largest crypto theft on record1.
- Bybit's February 2025 loss, the prior record, ran to $1.5 billion1.
- 628: wallet addresses the FBI flagged across three blockchains in the Binance theft7.
- Tether froze more than $1.5 billion in stolen USDT within 30 minutes of the theft7.
- 89%: this year's reported crypto hack losses that Chainalysis attributes to North Korea's hackers5.
- Four earlier thefts the FBI ties to the same unit add up to $2.48 billion, before Binance's own1.
What to watch
Binance's unfrozen funds are worth tracking next. A route through bitcoin swaps and over-the-counter brokers would match the pattern TRM Labs found in four earlier thefts. The Department of Justice filing charges against named individuals is another marker. That step turned blockchain tracing into courtroom evidence after the Bybit theft. Chainalysis's next annual count closes the loop. A sixth theft bearing this signature would answer North Korea's denial on its own. So would a sanctions action naming the specific laundering brokers Vidmanov described, the kind of order Treasury has issued before.
Sources
- "FBI links $6.3 billion Binance crypto heist to North Korean hackers," BleepingComputer, Nov. 2, 2026, https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/
- "North Korea Denies $6.3B Binance Hack, Calls FBI Finding a 'Political Provocation,'" Decrypt, Nov. 3, 2026, https://decrypt.co/382394/north-korea-denies-6-3b-binance-hack-calls-fbi-finding-a-political-provocation
- "North Korea denies role in $6.4 billion Binance hack after FBI points to TraderTraitor," CoinDesk, Nov. 3, 2026, https://www.coindesk.com/business/2026/11/03/north-korea-denies-role-in-usd6-4-billion-binance-hack-after-fbi-points-to-tradertraitor
- "Binance says $6.3bn stolen in biggest crypto heist in history: What we know," Al Jazeera, Oct. 30, 2026, https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know
- "North Korea supercharges crypto heists with AI skills," Taipei Times, Nov. 3, 2026, https://www.taipeitimes.com/News/world/archives/2026/11/03/2003867075
- "COVER STORY: North Korea has every incentive to keep stealing crypto, analysts say," The Korea Times, Nov. 1, 2026, https://www.koreatimes.co.kr/foreignaffairs/northkorea/20261101/cover-story-north-korea-has-every-incentive-to-keep-stealing-crypto-analysts-say
- "FBI Flags Over 600 Addresses Tied to North Korea's Binance Heist," SecurityWeek, Nov. 2, 2026, https://www.securityweek.com/fbi-flags-over-600-addresses-tied-to-north-koreas-binance-heist/