North Korea denies being behind the USD 6.3 billion crypto theft at Binance and calls the FBI attribution "absurd rhetoric". At the same time, the exchange reports that customer outflows have normalized.
Binance is the world's largest crypto exchange and holds balances that customers can withdraw at any time. That ability to withdraw is the real capital of an exchange. If an exchange suspends it, pressure to pull funds builds. The FBI is the federal police agency of the United States. At times, it publicly attributes major cyberattacks to state actors. Binance reported the theft on October 29, 2026, and initially froze withdrawals for more than two days. Analytics firms have since largely reconstructed the technical sequence of events. The precedent is the USD 1.5 billion hack at Bybit in February 2025. In that case, the FBI also named North Korea as the attacker. The Binance case is therefore about four times as large. By November 2, customers had pulled a net USD 4.72 billion from the platform. Pyongyang's response to the FBI attribution from the weekend came on Tuesday.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
Pyongyang calls the FBI attribution absurd rhetoric
Over the weekend, the FBI held North Korea responsible for the theft of more than USD 6 billion in crypto assets. Earlier, the analytics firm TRM Labs had already attributed the attack to North Korea with high confidence. Pyongyang replied through the state agency KCNA. Kim Yo Jong is the influential sister of leader Kim Jong Un and a party official. She called the US claim "absurd rhetoric and nothing new". In her account, the FBI wants to brand the DPRK a "cyber criminal state". It bases this on information that a hacker group "backed" by the DPRK took part.
"It is a grave political provocation against the DPRK that the US misleads the international public as if all cybercrimes in different parts of the world were our acts." - Kim Yo Jong
Furthermore, Kim Yo Jong said North Korea had "things to reconsider" in light of US hostility. She did not specify what. Pyongyang has so far not responded to offers made this year by President Donald Trump to resume summit diplomacy. Likewise, the country denies any link to crypto theft and other cybercrime as a matter of principle. Analysts in Seoul, however, noted the speed of the reply. In their view, the unusually fast reaction likely reflects concern in Pyongyang. The attribution could bring tougher measures against the regime's suspected sources of revenue. For now, an official attribution thus stands against a state denial.
Binance sees outflows normalized after 24 hours
Co-CEO Richard Teng commented on the state of the exchange at Hong Kong Fintech Week. Withdrawals spiked in the first 24 hours, he said. After that, the situation "pretty much normalized". Overall, Binance is in "very strong financial shape", Teng said. According to him, Binance has also replenished 95% of the affected tokens. "We can cover that. We are able to do so," the executive said.
Besides the cumulative net outflow of USD 4.72 billion, the exchange cites a relative figure. Since withdrawals resumed, however, the net outflow has equaled only about 3% of platform assets. Analysts view this as relatively moderate. They also see it as a sign that customer trust has largely held. Before that, Binance had frozen withdrawals for more than two days and gradually reopened them from November 1. In a post on X, the exchange later reported that hourly deposits now exceed withdrawals. According to Binance, this reflects better user activity and stabilized flows. Maksym Repa is Head of DeFi at the Bitcoin finance protocol Lombard. He also views the limited price reaction as a sign of maturity. In his assessment, investors distinguished between a security failure at a centralized exchange and a problem with the Bitcoin network.
Notably, Binance is offering financial incentives while it reports stable flows. Since early November, a "Community Appreciation Campaign" has offered fee discounts and rewards. It targets users with cumulative trading volume of USD 10,000 or more. In addition, certain yield products pay up to 10% APR. The campaign ends on November 21, 2026. Still, the normalization remains a self-report by the exchange. In early November, Binance did complete a cryptographic proof of reserves for ten assets that customers can verify themselves. Its cutoff date, though, is October 31. As a result, it does not capture the outflows after withdrawals resumed. Nor does it replace a third-party audit.
How crypto theft funds weapons programs in North Korea
Analysts see crypto theft as a key source of funding for North Korea's weapons programs. Moreover, cybersecurity experts rank the country's hackers among the most prolific crypto thieves in the world. The analytics firm Elliptic estimates their haul for 2026 at USD 7.6 billion, more than in any previous year. South Korea's central bank puts North Korea's gross domestic product for 2025 at 47.18 trillion won (USD 35.09 billion). The Binance theft alone would consequently equal roughly one sixth of economic output.
Chainalysis traces the trend over five years. According to the firm, 89% of all losses from crypto hacks in 2026 have links to North Korea. In 2021, the share was 15%. Meanwhile, the average reported loss per hack rose from USD 50.65 million to USD 185.65 million. That is more than 3.6 times as much. Alec Zebrick, Senior Manager Asia-Pacific Global Services at Chainalysis, describes it as big game hunting. The attackers target larger exchanges that require more time and complexity. In return, the haul can be relatively large.
Lim Eul-chul is a professor at the Institute for Far Eastern Studies at Kyungnam University. He places the figures in the context of sanctions. Under the existing sanctions, he said, crypto theft has become one of the main channels for regime survival and weapons development. Additional US measures against wallets, money laundering networks and exchanges could therefore cut off a key source of revenue. Besides the crypto haul, proceeds from activities banned by UN Security Council resolutions also flow into missile and nuclear programs. The link between this revenue source and the quick denial is an interpretation by analysts in Seoul. It remains unproven.
Responsibility and the fate of the stolen funds remain open
North Korea's responsibility rests on the FBI attribution and on TRM Labs' own forensics. Pyongyang, by contrast, offers a blanket denial. It remains unclear what lies behind the statement that North Korea has "things to reconsider". Kim Yo Jong left the remark unexplained.
Teng has announced an investigation report on the hack. Binance has not published it yet. Recovery is hardest for the part of the haul that no issuer can freeze. At the end of October, TRM put this portion at about USD 2.4 billion in Bitcoin and Ether. As the next laundering stops, the analytics firm also expected cross-chain bridges, swap services and OTC dealers.
