North Korea denies FBI accusation over $6.3bn Binance hack

Kim Yo-jong, sister of North Korean leader Kim Jong-un and a senior Workers’ Party official, dismissed the FBI’s accusation as a “grave political provocation” in a statement carried by state news agency KCNA on 3 November. She accused the US of linking international cybercrime to North Korea to damage its image.

The FBI said on 31 October that North Korea was responsible for the theft of more than $6 billion in digital assets from Binance around 29 October. It calls the cyber activity TraderTraitor, but did not set out the full basis for its attribution in the public alert.

Blockchain analysis firm TRM Labs also attributed the attack to TraderTraitor, which it describes as a North Korean hacking unit, with high confidence. It said its assessment drew on information from transactions and other intelligence, including similarities with earlier attacks linked to North Korea. Those included advance preparation and signatures obtained before the theft. TRM noted that the laundering pattern it had observed so far differed from that seen after an earlier attack.

The firm’s assessment is part of a wider set of clues examined by investigators, but the identity of the attackers and any direct state direction remain disputed.

Binance estimated the impact at around $6.3 billion and temporarily suspended withdrawals. It said it would cover losses using company money and its SAFU fund. The BBC reported that Binance had since said it had covered around 95% of the affected assets; replacing assets is not the same as recovering them from the attackers.