North Korea has denied allegations that it was behind the Binance attack, the largest cryptocurrency theft on record. Blockchain analytics firms and the FBI had attributed the attack, which involved more than $6 billion, to North Korean hackers.
According to Yonhap News Agency, citing state news agency KCNA, Kim Yo-jong, the sister of North Korean leader Kim Jong-un, criticized the FBI’s attribution of the attack to the TraderTraitor group. Kim called the accusation a “serious political provocation” and accused Washington of misleading international opinion by portraying cybercrimes worldwide as the work of North Korea.
Kim said the FBI was attempting to brand her country a “cybercriminal state.” She recalled that the United States had also attributed last year’s Bybit hack to North Korea, dismissing the allegations as absurd and a repetition of earlier claims.
North Korea also conducted a strategic cruise missile test following the statement.
The attack lasted approximately 20 minutes
According to TRM Labs, the attacker drained approximately $6.36 billion from Binance wallets across 10 blockchains in around 20 minutes on October 29. The amount was roughly four times the $1.5 billion stolen in the February 2025 Bybit hack.
TRM said preparations began at least 36 hours before the attack and that the operator’s wallet received funding through Tornado Cash. The attacker first tested the malicious code on three wallets.
On Ethereum, the attacker used the EIP-7702 standard to turn a Binance hot wallet into a sweeper wallet under their control. To do so, the attacker prepared 50 signed authorizations in advance.
Following the attack, Tether froze approximately $1.77 billion in USDT, while Circle froze around $825 million in USDC.
FBI lists more than 600 addresses
Three firms, including TRM Labs, linked the attack to North Korea. Over the weekend, the FBI also confirmed that North Korea was behind the theft.
The FBI said the state-sponsored TraderTraitor group, active since at least 2020, had converted the stolen assets primarily into Ether. Its advisory listed 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address.
The FBI urged a wide range of services, from THORChain node operators to DeFi platforms, to block transactions linked to these addresses. According to analyst SomaXBT, the hackers laundered approximately $242 million through the Tron network in the first two days.
The FBI had also attributed the February 2025 Bybit attack to TraderTraitor.
Binance replaces 95% of affected assets
Binance published its first proof-of-reserves report following the attack on Monday. The exchange said it had replaced approximately 95% of the affected assets using its own funds.
Binance also announced that it would gradually reopen withdrawals for additional assets and networks.
