Binance Hack: Kim Yo-jong Reportedly Rejects FBI Attribution

The Binance hack is at the center of a public dispute after Kim Yo-jong, sister of North Korean leader Kim Jong Un, reportedly called the FBI’s probe a “political provocation.” In an October 31 alert, the FBI attributed the theft of more than $6 billion in virtual assets to North Korea-linked activity known as TraderTraitor. The reporting available here does not include the full text of Kim’s remarks or evidence from Pyongyang supporting its position.

What we know about the Binance hack

Binance hack timeline and attribution

Binance said its hot wallets were compromised at about 20:05 UTC on October 29, 2026, with estimated losses of $6.3 billion. The company said it would cover the stolen funds through its SAFU fund and corporate treasury, rather than pass the loss to users. In an October 30 update, Binance said about $3 billion in affected assets had been frozen on-chain. Its initial investigation suggested a compromised laptop. Binance said it found additional points of breach but no evidence that wallet private keys were leaked.

On October 31, the FBI attributed the theft to North Korea and identified the activity as TraderTraitor. The bureau said more than $6 billion in virtual assets were involved and urged crypto and blockchain services to block transactions linked to addresses in its alert. The FBI’s public alert on the Binance theft does not mention Kim Yo-jong or her reported response.

BeInCrypto reported, citing Yonhap News Agency, that Kim called the probe a “political provocation” and said Pyongyang was “closely monitoring” the situation. Citing Reuters, the outlet also reported that North Korea’s state news agency KCNA called the theft claims a fabrication. The Block reported on November 2 that North Korea was reportedly denying responsibility. These statements do not independently establish who controlled the wallets.

The Associated Press reported that the FBI linked TraderTraitor to the same actors it tied to the $1.5 billion Bybit theft in 2025. BeInCrypto also reported that blockchain tracking firms TRM Labs and Chainalysis linked the Binance attack to North Korea. The evidence provided does not include those firms’ underlying analyses.

What is still unclear

What the Binance hack denial does not settle

The available reports do not include the full text of Kim’s remarks, identify which evidence she disputes, or provide technical evidence from Pyongyang supporting its denial. The supplied reporting does not show the FBI withdrawing or revising its October 31 attribution. The alert states the bureau’s position, but the available evidence does not resolve the competing claims.

The final disposition of the stolen assets is also unclear. On November 2, Elliptic reported that about $2.85 billion, or 44% of the stolen funds, had been frozen or seized, while about $3.28 billion remained across more than 950 wallets. These are tracking figures reported that day, not a final accounting. CoinDesk reported that Elliptic found no evidence AI agents directed the laundering.

Binance’s coverage of the impacted amount is separate from tracking the stolen tokens. On November 2, the exchange said it had covered approximately 95% of the impacted amount. It also said users could verify 1:1 backing for ten named assets through a completed zero-knowledge proof. That does not mean Binance retrieved 95% of the stolen funds.

How markets and analysts reacted

Bitcoin, Ethereum and BNB were lower over the 24 hours ending November 2, 2026, at 22:31 UTC, according to the CoinGecko data provided for this report. The snapshot shows market movement during a developing story; it does not establish that the hack or Kim’s reported denial caused the changes.

Alternative.me’s Crypto Fear & Greed Index was 37, classified as “Fear,” on November 2. It reflects broader market sentiment and does not isolate reactions to this incident. The Associated Press reported that President Donald Trump said on October 31 that investigators did not yet know whether North Korea was involved, despite the FBI’s public attribution.

Binance said on November 1 that withdrawals were resuming in phases, deposits remained open, and coverage had reached approximately 95%. Its November 2 recovery update reported the coverage figure and proof-of-reserves statement. Binance’s updates and other services’ efforts to block transactions are separate parts of the response.

What it means for investors

The Binance hack has raised questions about exchange security, access to funds during a disruption and the movement of stolen assets. Binance has pledged to cover the impacted amount through its SAFU fund and corporate treasury. That describes its response to this incident; the supplied evidence does not establish what it means for other exchanges or their customers.

Attribution claims inform public discussion but remain distinct from statements by the parties accused. BeInCrypto reported that US agencies were asking exchanges to block wallets tied to the stolen funds. The FBI alert also urged crypto and blockchain services to block transactions linked to listed addresses. The available reporting does not establish how those requests affected eventual recovery.

The reporting includes Binance’s account of its response, the FBI’s attribution and statements attributed to North Korean officials. As of November 2, Elliptic reported that some funds had been frozen or seized and billions remained across wallets. These figures and public statements may change as the incident develops.

Bottom line

Kim Yo-jong’s reported denial has not displaced the FBI’s public attribution of the Binance hack to North Korea and TraderTraitor. The evidence behind the competing claims and the final disposition of the stolen funds remain open questions. Binance’s reported coverage of the impacted amount is not the same as recovery of the stolen tokens.

Sources

• North Korea Responsible for $6 Billion+ Binance Attack (www.fbi.gov)
• Security Incident | Recovery Update #5: October 31st PoR Snapshot Now Fully Verifiable by Users as ZK Proof Generated (2026-11-02) (www.binance.com)
• Kim Jong-Un’s sister rejects FBI claims linking North Korea to record $6 billion Binance hack: reports (The Block)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.