North Korea Denies Binance Hack: $6.3B Theft Explained

North Korea has formally denied any involvement in the record-breaking $6.3 billion Binance hack, dismissing FBI allegations as 'absurd rhetoric' and a 'serious political provocation.' The statement, delivered by Kim Yo-jong, the influential sister of leader Kim Jong-un, marks Pyongyang's first official response to accusations that state-backed hackers stole more than 5.6 billion euros in virtual assets from the world's largest cryptocurrency exchange. The denial comes as international pressure mounts on North Korea over its alleged use of cybercrime to fund weapons programs.

What happened in the Binance hack?

On October 29, 2026, attackers breached Binance and made off with over $6 billion in cryptocurrency, the largest digital-asset heist in history. The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, attributed the attack to TraderTraitor, a North Korean state-sponsored group also known as Lazarus Group. Investigators say the hackers converted stolen Bitcoin into Ethereum and may use further laundering phases through decentralized finance and instant swap services. The Lazarus Group cyber attacks have previously targeted banks, exchanges, and government networks worldwide.

North Korea's official denial

Kim Yo-jong rejected the accusations, calling them a 'grave political provocation' and accusing Washington of habitually blaming Pyongyang. 'The U.S. is misleading international public opinion by suggesting that all cybercrime in the world is our work,' she said in a statement carried by state media. She pointed to a previous hack of the ByBit exchange in early 2025, when the FBI also blamed a North Korean group for stealing $1.5 billion. That theft was then the largest crypto heist on record. The Bybit hack investigation remains a point of contention between the two countries.

FBI evidence and the TraderTraitor group

The FBI's cyber alert, issued October 31, 2026, stated that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance. The agency designated the activity as TraderTraitor and published a list of Ethereum addresses holding or having held stolen funds. Analysts note that the Lazarus Group has been linked to several major incidents, including the 2014 Sony Pictures hack and the 2017 WannaCry ransomware attack. Experts say North Korea increasingly uses crypto theft to raise foreign currency for its economy and nuclear program. The North Korea cryptocurrency theft trend has drawn warnings from South Korea and the United States.

Impact on Binance and crypto markets

Binance disclosed that an engineer's compromised laptop enabled unauthorized withdrawals, but trading has since resumed. The exchange reported that approximately 95% of stolen assets have been covered and described the impact as limited, with net outflows of $4.72 billion against roughly $157 billion in total assets. The Binance hack surpasses the previous record of $1.5 billion stolen from ByBit in early 2025, underscoring the escalating scale of cyberattacks on crypto platforms. Blockchain analytics firms are tracking the stolen Ethereum addresses, and the FBI has urged virtual asset service providers to block transactions tied to the hack. Nevertheless, the incident has renewed scrutiny on cryptocurrency exchange security and the ability of platforms to withstand sophisticated state-backed attacks. Regulators and investors are now questioning whether existing safeguards are sufficient to protect user funds.

Frequently Asked Questions

Who is behind the Binance hack?

The FBI attributes the October 2026 Binance hack to TraderTraitor, also known as the Lazarus Group, a North Korean state-sponsored hacking organization.

How much was stolen from Binance?

Hackers stole more than $6 billion, or approximately 5.6 billion euros, making it the largest cryptocurrency theft in history.

Has North Korea admitted to any crypto hacks?

No, North Korea has denied involvement in the Binance hack and previous incidents, including the ByBit hack, calling the allegations politically motivated.

What is TraderTraitor?

TraderTraitor is the FBI's designation for the North Korean hacking group also known as Lazarus Group, responsible for numerous cyberattacks and financial thefts since 2009.

Will Binance recover the stolen funds?

Binance says about 95% of stolen assets have been covered, and trading has resumed, though full recovery remains uncertain as laundering continues.