North Korea has denied responsibility for the roughly $6.3 billion Binance cryptocurrency theft after the FBI attributed the attack to North Korean cyber activity it tracks as TraderTraitor.
Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, rejected the allegations in a Nov. 3 statement carried by state media. Blockchain intelligence firms Chainalysis and TRM Labs have also attributed the attack to TraderTraitor.
For crypto exchanges and compliance teams, the immediate challenge is identifying exposure to the stolen funds and restricting their movement while investigations continue.
“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” Kim Yo Jong said in a statement carried by KCNA.
Binance’s response update acknowledges the FBI’s finding that North Korea was responsible, while saying its investigation remains ongoing.
The exchange said it had set aside more than enough funds to cover the loss and was purchasing replacement token assets. Replenishing those assets is separate from recovering the stolen cryptocurrency.
What the evidence says
The FBI said it and its partners at the US Secret Service and IRS Criminal Investigation observed TraderTraitor actors converting stolen assets primarily into ether (ETH). Its public alert did not detail the evidence underlying its attribution.
Chainalysis said its strongest disclosed evidence was the commingling of stolen Binance funds with proceeds from the Bitget theft. Its Bitget investigation dates that $387 million attack to Sept. 24 and attributes it to North Korean actors.
Blockchain records show how funds move, but a transaction alone does not establish the real-world identity controlling an address. Investigators can combine transaction analysis with exchange records and other intelligence to support attribution.
TRM Labs said that it was able to use both on-chain and off-chain intelligence to derive its attribution. The company hasn’t detailed what particular off-chain intelligence it used, but it said that it made “this judgment with high confidence.” It also said that it will provide more information as the investigation develops.
What crypto security teams should check
The FBI’s alert urges virtual asset service providers and other private-sector organizations to block transactions involving or derived from addresses associated with the theft. For exchanges and compliance teams, the practical starting point is reviewing those addresses against their screening systems and transaction history.
Teams should investigate relevant matches, preserve transaction records, and escalate findings through their security and compliance processes. Reviewing historical activity matters because exposure may have occurred before an address was identified. Screening controls also need updating as investigators publish additional findings.
Prevention also requires attention to developer access. Separate North Korean campaigns have used fake recruitment and interview workflows to compromise developers and blockchain smart contracts to conceal crypto-stealing malware. Those cases reinforce the need to scrutinize recruiter-supplied code and protect credentials on developer workstations; they do not establish how the Binance attackers gained access.
Organizations should distinguish blocking activity within their own services from freezing assets across a blockchain. An exchange can restrict activity on its platform, and some token issuers can freeze their tokens. Those controls do not give every node operator the ability to prevent transfers across an entire network.
TRM Labs reported that small Tornado Cash withdrawals funded the attacker’s operator wallet before the theft. That finding concerns attack preparation; it does not establish that stolen Binance funds were subsequently withdrawn through the service.
The Binance incident also highlights the importance of separating funds frozen, assets recovered, and reserves replenished. Freezing can restrict movement without returning assets to the victim. Replenishment means replacing missing assets, rather than necessarily retrieving the stolen funds.
The FBI’s alert requests industry cooperation but does not itself establish a blanket legal obligation for every crypto organization. Compliance teams should determine which obligations apply to their operations and jurisdictions. They can assess exposure and strengthen controls while investigators continue developing the attribution and recovery picture.
Read more: The Liquid Network theft and partial return of stolen bitcoin show why recovery claims need to distinguish assets returned from losses still outstanding.