North Korea denies Binance crypto heist, calling FBI blame a 'provocation'

What happened at Binance

Binance, the world's largest cryptocurrency exchange, said on Friday, 30 October, that hackers had stolen crypto from its wallets. An FBI alert places the theft on or around 29 October. Binance estimates its losses at around $6.3 billion, while The Independent reports the theft as more than $6 billion. Investigators believe the attackers got into a software engineer's laptop, which gave them a route to the systems that process withdrawals. Binance froze the remaining accounts to protect the funds, and US cybersecurity firms linked the attack to the TraderTraitor group the same day.

FBI attribution and the Bybit link

On Saturday, 31 October, the FBI said the theft was orchestrated by North Korean hackers and attributed it to TraderTraitor. In its statement the agency described the activity as malicious North Korean cyber activity. The same group is tied by the FBI to the $1.5 billion hack of the Bybit exchange in February 2025. Reports describe the Binance theft as the largest cryptocurrency heist on record.

Binance theft (Binance estimate)6.3

Bybit hack (February 2025)1.5

Binance theft (Binance estimate)

6.3 USD billion

Bybit hack (February 2025)

1.5 USD billion

Data from the article text

Pyongyang rejects the accusation

North Korea denied any role and called the FBI's claim a political provocation staged by Washington. Kim Yo Jong, sister of leader Kim Jong Un, made the statement, which was carried by the state news agency KCNA in early November. She argued that the US claim was absurd rhetoric offering nothing new, and that it repeated earlier American accusations about the Bybit attack. She accused Washington of trying to mislead global opinion by pinning every cybercrime on North Korea.

“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community”

She added that the episode confirmed Washington's hostility toward Pyongyang and that North Korea was monitoring what it called ongoing US provocations against its state.

Experts on AI and the pattern of theft

Security sources cited by Bloomberg believe North Korean hackers may be using AI models to research targets, spot weaknesses and deceive employees, although the use of AI has not been confirmed. Federico Charosky of Quorum Cyber told Bloomberg that a common approach involves fake job interviews with exchange engineers, during which victims are persuaded to install malicious code. Ari Redbord of TRM Labs said North Korea had stolen roughly as much in one evening as it had in the previous six years combined.

“This is an inflection point, and this attack is unprecedented”

According to crypto.news, citing TRM Labs, groups linked to North Korea accounted for around 76% of cryptocurrency hack losses in the first four months of 2026. Two attacks in April, on KelpDAO and Drift Protocol, caused losses of around $600m combined.

Long-running pattern and wider context

South Korea's spy agency estimated in December 2022 that North Korean hackers had taken 1.5 trillion won, about $1.1 billion, in cryptocurrency and other virtual assets over the previous five years. Pyongyang has mostly denied involvement, yet it has been linked to a 2013 campaign that crippled the servers of South Korean financial institutions, the 2014 hack of Sony Pictures and the WannaCry malware attack of 2017. Seoul's foreign ministry warned on Monday that North Korea's cyber operations are a rising danger to the worldwide digital economy.