North Korea Denies $6.3 Billion Binance Hack as FBI Lists 628 Wallets

North Korea has denied responsibility for the record $6.3 billion theft from cryptocurrency exchange Binance, days after the FBI blamed a state-linked hacking unit for the heist and published a list of 628 wallet addresses tied to the stolen funds.

Kim Yo Jong, the sister of North Korean leader Kim Jong Un, rejected the FBI’s accusation on November 3 in a statement carried by North Korean state media, calling it “absurd rhetoric” and accusing the United States of repeatedly linking Pyongyang to international cybercrime. The denial came as Binance continued to restore customer withdrawals in phases and as the fallout spread through crypto markets, with Bitcoin falling below $77,000 and more than $1 billion flowing out of spot Bitcoin exchange-traded funds.

The FBI’s accusation

The FBI said on October 31 that North Korea was responsible “for the theft of more than $6 billion USD in virtual assets” from Binance, attributing the attack to TraderTraitor, a hacking operation US officials link to the Lazarus Group. In an alert dated the same day, investigators asked crypto firms to block transfers involving 628 wallet addresses — 608 on Ethereum, 19 on Bitcoin and one on Solana — that are holding or once held proceeds of the theft.

Blockchain analytics firms reached the same conclusion independently. TRM Labs attributed the attack to TraderTraitor “with high confidence,” while Chainalysis said it had a “high degree of confidence” that North Korea was responsible, putting the total at $6.4 billion. Elliptic estimated about $6.43 billion. Binance itself has described the impact as approximately $6.3 billion and has not confirmed the attribution.

The scale dwarfs every previous crypto theft. It is roughly four times the $1.5 billion taken from rival exchange Bybit in February 2025, an attack also blamed on the same North Korean operation.

How the theft unfolded

According to Binance and blockchain investigators, unauthorised transfers from Binance’s hot wallets — the online wallets used to process day-to-day withdrawals — began at about 20:05 UTC on October 29. TRM Labs said about $6.36 billion moved across ten blockchains, most of it within roughly 20 minutes.

Binance first traced the entry point to a compromised laptop belonging to a DevOps engineer, the role that runs the infrastructure used to deploy software, and later reported additional points of breach. The exchange suspended withdrawals, then deposits, and on October 30 put the impact at about $6.3 billion.

About $3 billion of the stolen funds has since been frozen. Tether froze about $1.6 billion in USDT, Circle more than $800 million in USDC, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, according to investigators’ tallies.

Withdrawals resume as customers pull billions

Binance began reopening withdrawals in phases from 06:00 UTC on November 1 and added more assets to the process on November 3. In the first phase alone, customers withdrew $4.65 billion and deposited $1.01 billion between 06:00 and 15:30 UTC on November 1 — a net outflow of about $3.64 billion, or 2.1% of the exchange’s $171 billion in assets.

The exchange has said it will absorb the loss itself rather than pass it on to users, drawing on its Secure Asset Fund for Users (SAFU) emergency reserve and corporate funds. By November 1 it said it had replaced about 95% of the affected assets, and it set aside more than $6.34 billion to cover the loss. Ten tokens — including Bitcoin, Ether, USDT, BNB, Solana, USDC and XRP — are fully backed, Binance said.

A full technical post-mortem has not yet been published, and Binance’s proof-of-reserves report, which lets users verify their balances are counted in the exchange’s holdings, was expected on November 3 after a delay from an earlier Monday target.

Markets feel the shock

The theft rattled crypto markets within hours. Bitcoin fell below $77,000, and more than $1 billion left spot Bitcoin ETFs, according to market coverage of the November 4 session. The episode has renewed questions about how much of the crypto industry’s infrastructure rests on a handful of large exchanges — and about how effectively stolen funds can be laundered when investigators can freeze stablecoins but not every asset.

For US officials, the wallet blocklist is the next test. The FBI, the Secret Service and IRS Criminal Investigation are jointly urging firms that route and process crypto payments to turn away any transfer touching the listed addresses. Whether that pressure can recover a meaningful share of the remaining roughly $3 billion in unfrozen funds — or simply push it further into decentralised channels — is now the open question.

What happens next

Investigators say the case remains active, with the Secret Service continuing its inquiry alongside the FBI. Binance has said it is cooperating with law enforcement and working to freeze further assets. North Korea’s denial, meanwhile, follows a familiar pattern: Pyongyang has repeatedly rejected US cybercrime accusations, including over the Bybit theft.

What is not in doubt is the record the attack has set. At more than $6 billion, the Binance theft is the largest cryptocurrency heist ever recorded — and a reminder that, for all the industry’s growth, its biggest platforms remain high-value targets.