North Korea Rejects FBI Blame for $6.3 Billion Binance Hack

North Korea rejected the FBI’s attribution of the roughly $6.3 billion Binance hack in a Nov. 2 statement carried by state news agency KCNA.

Kim Yo Jong, a department director of the Central Committee of the Workers’ Party of Korea, called the U.S. assertion “an absurd rhetoric and nothing new.” She said the government opposes malicious acts in cyberspace and accused Washington of a “grave political provocation.”

The FBI’s Oct. 31 alert, previously reported by The Defiant, said North Korea “was responsible” for the theft on or about Oct. 29 and named the activity “TraderTraitor.” The bureau said it and partner agencies had observed the attackers converting stolen assets primarily into ether.

Blockchain analytics firm Chainalysis said on Oct. 30 that it had a “high degree of confidence” in North Korea’s responsibility. Its investigators said funds stolen from Binance were commingling with proceeds of September’s Bitget exploit that the firm attributed to North Korea.

Kim’s statement attacked the U.S. accusation but did not address the commingling evidence cited by Chainalysis.

The FBI urged crypto businesses, DeFi services and infrastructure operators to block transactions “with or derived from” the addresses listed in its alert. That alert does not announce a sanctions designation or authorize the return of frozen assets.

Where virtual currency is blocked under U.S. sanctions, Treasury’s Office of Foreign Assets Control guidance says it can be unblocked and returned only with OFAC authorization or when the legal prohibition ceases to apply. North Korea’s denial does not supply either condition.

Binance estimated the loss at approximately $6.3 billion in its Oct. 30 update and said roughly $3 billion had been frozen onchain at that point. Recovering those proceeds is separate from the exchange’s effort to replace stolen tokens using company funds.

In a Nov. 2 recovery update, Binance said it had covered approximately 95% of the impacted amount. The remaining 5% consisted of less-liquid tokens that take longer to source. The exchange said its next phase of withdrawals for additional networks and assets was planned for Nov. 3.