Buy a Licensed Company 
Explore VASP Data 
Talk to an Expert 
Dren Hima
Dren Hima is Head of Research at Coincub, leading research across digital asset regulation, licensing, market structure, tokenization and institutional adoption.
North Korea Denies FBI Claim It Stole $6.3B From Binance
North Korea, through Kim Yo-jong, denied responsibility for the $6.3 billion Binance theft and called the FBI’s attribution a political provocation. The FBI named TraderTraitor, and analytics firms traced the funds across 12,000 wallets.
North Korea denied responsibility for the $6.3 billion theft from Binance, a major crypto exchange, after the Federal Bureau of Investigation (FBI), the US federal law enforcement agency, attributed the attack to a North Korean group. Kim Yo-jong, the sister of leader Kim Jong-un, issued the denial.
- Kim Yo-jong called the FBI’s attribution a “grave political provocation” meant to damage North Korea’s reputation.
- The FBI named TraderTraitor, a state-sponsored group associated with the Lazarus Group, as responsible for stealing more than $6 billion in digital assets from Binance.
- Elliptic traced the stolen assets through approximately 12,000 wallets across 11 blockchains and more than 40,000 transactions.
North Korea rejects the FBI attribution
Kim Yo-jong dismissed the FBI’s findings, according to a Yonhap News Agency report citing a statement from the state-run Korean Central News Agency (KCNA). She described the attribution of the October 29 attack to North Korean hackers as a “grave political provocation.”
Kim accused US authorities of trying to portray North Korea as a cybercriminal state and of unfairly blaming it for hacking incidents worldwide. She said the allegations were meant to damage the country’s international reputation and infringed its sovereignty in cyberspace.
She also suggested Washington may have ulterior motives tied to recovering the stolen crypto. She referred to US plans to confiscate illicit digital assets. Kim said that examining who benefits from recovered funds could provide clues about the perpetrators, but she presented no evidence. Yonhap noted her direct intervention in a hacking dispute was unusual. North Korea has repeatedly denied responsibility for crypto thefts attributed to state-backed hackers.
Kim ended the statement by warning that Pyongyang was closely watching Washington’s actions and could reconsider aspects of its response to what it called continued US hostility.
Analytics firms link the Binance theft to TraderTraitor
TRM Labs, a blockchain intelligence firm, attributed the attack to TraderTraitor with high confidence. It cited blockchain activity and intelligence gathered outside public networks. Independent investigator ZachXBT identified the Lazarus Group, which has been linked to TraderTraitor, as the likely perpetrator.
AMLBot, a blockchain analytics firm, said funds from the Binance theft and a September attack on Bitget converged in common wallets.
Frozen funds and the response from Binance and the FBI
Investigators describe the breach as the largest cryptocurrency theft on record. It involved unauthorized transfers across several blockchain networks, including Ethereum and Bitcoin.
Binance published its incident report on November 3. It said the attack began in September, when a wallet engineer approached through a fake job offer installed a malicious code repository on a work machine. The attackers then used an internal AI tool to reach other wallet engineers, and a compromised signing service to take control of a hot wallet. Binance said it found no evidence that its wallet private keys had leaked, and that it has replenished 98% of affected tokens.
Elliptic traced the stolen assets across 12,000 wallets and 11 blockchains in fewer than four days. It estimated only a negligible portion of the proceeds had been converted into cash.
The FBI urged crypto exchanges and other digital asset businesses to block transactions linked to the attackers’ identified wallets. Binance said about $2.85 billion of the stolen funds has been frozen or intercepted, the same figure Elliptic gave. Tether, the issuer of the USDT stablecoin, said it froze more than $1.5 billion in USDT
Binance in Coincub Data
The theft hit an exchange that draws 21.1 million unique monthly visitors, according to Coincub Data. About 26% of that traffic comes from countries where Binance holds a license, a measure Coincub tracks as compliant traffic. The brand has 15 registered companies across 10 countries, and Coincub Data lists its headquarters in the United Arab Emirates, where Binance.com is regulated by the Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market through three licensed entities.
