New Delhi: North Korea rejected US allegations on Tuesday that it was behind a reported $6.3 billion cryptocurrency theft from Binance. The exchange has replenished about 95 per cent of affected assets using its own funds while progressively restoring customer withdrawals after a surge in outflows.
Kim Yo-jong, sister of North Korean leader Kim Jong-un, called the Federal Bureau of Investigation’s (FBI) allegation “absurd rhetoric and nothing new”, according to state agency KCNA. She described it as a “grave political provocation” and warned that Pyongyang had unspecified issues to reconsider over Washington’s hostile attitude.
The FBI attributed the October 29 theft to TraderTraitor, which it identifies as a North Korean state-linked hacking operation, in an October 31 alert. It published cryptocurrency addresses tied to the stolen funds and urged exchanges and other virtual-asset providers to block transactions associated with them.
US investigators said the stolen assets were being converted chiefly into Ether and could be laundered further using decentralized finance and instant-swap services. The attribution is an FBI assessment disputed by Pyongyang, not a court finding.
The FBI has not publicly released its complete forensic findings, although its alert identifies cryptocurrency addresses associated with the stolen funds, CoinDesk reported. Blockchain analytics firm Elliptic separately said its investigation supported the attribution to North Korea’s TraderTraitor operation. The firm reported that approximately $2.85 billion of the stolen assets had been frozen or seized, although that does not mean the funds have been returned to Binance.
The bureau also blamed TraderTraitor for the February 2025 theft of approximately $1.5 billion from Bybit. US authorities have linked such cyber operations to North Korean efforts to obtain funds despite international sanctions; Pyongyang denies involvement.
Binance replenishes assets, restores withdrawals
Binance initially suspected that a compromised employee laptop was involved in the attack, but subsequent investigations uncovered additional breach points, as RNA Media reported on October 30.The exchange said it had found no evidence that wallet private keys were exposed. The findings remain preliminary, with the company promising a detailed report once its investigation is completed.
Binance said it had used its secure asset fund for users (Safu) and other company reserves to replace approximately 95 per cent of affected tokens. The outstanding 5 per cent consists mainly of less-liquid assets that take longer to acquire, including through over the counter providers.
Replenishment means Binance has replaced affected assets using its resources, not necessarily recovered stolen funds from the attackers. The exchange says customers will not bear the financial loss and has promised a report on the incident.
At Hong Kong Fintech Week on Tuesday, Binance co-chief executive, Richard Teng, described the company as being in “very strong financial health”. He said the initial jump in withdrawals had “pretty much normalized”, although withdrawal access still varied by network and token.
Withdrawals were suspended for more than two days after the attack and began reopening in phases on November 1. A further rollout began at 04.00 UTC on Tuesday for selected assets on BNB Smart Chain, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, Tron and Base, subject to additional security checks.
Customer outflows and financial reassurance
Customers had withdrawn a net $4.72 billion by Monday, Reuters reported, citing Binance. A later company flow chart, covering November 1 to early November 3, showed $10.97 billion in gross withdrawals against $5.695 billion in deposits, leaving net outflows of about $5.28 billion over that period.
The figures cover different reporting intervals and are not directly comparable. Binance said deposits exceeded withdrawals in the hour beginning 3am UTC on Tuesday, although one positive hour does not establish a sustained reversal.
A proof of reserves verification published on Monday covers BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC at a minimum one to one backing ratio. The snapshot does not independently prove the exchange’s overall solvency or certify every liability.
Binance has also offered eligible users fee rebates and other rewards through November 21, while urging them to rely on official channels and avoid suspicious recovery offers. Its investigation and phased service restoration remain under way.