Pyongyang Rejects FBI Claim in Strongly Worded Statement
North Korea has denied any involvement in the theft of more than $6 billion from the cryptocurrency exchange Binance, rejecting a finding by the United States Federal Bureau of Investigation that a North Korea-linked hacking group carried out the attack. The denial, issued on Tuesday, 3 November 2026, through the state-run Korean Central News Agency, came days after Binance disclosed one of the largest thefts ever recorded in the cryptocurrency industry and days after American investigators publicly attributed the intrusion to a group they call TraderTraitor.
The statement was attributed to Kim Yo Jong, a senior North Korean official and the sister of leader Kim Jong Un. In the statement, she described the FBI investigation as a trite provocation and dismissed its conclusions as absurd rhetoric, according to reporting of the Korean Central News Agency text. She accused the United States of seeking to brand North Korea as a cyber criminal state, and she rejected the idea that Pyongyang was behind the Binance incident. The language was unusually direct, even by the standards of North Korean statements responding to American law enforcement findings, and it set up a direct clash between Pyongyang’s denial and Washington’s attribution.
The exchange at the heart of the dispute is Binance, the world’s largest cryptocurrency exchange by trading volume, which serves millions of customers around the world. When an exchange of that size reports a theft measured in billions of dollars, the consequences extend well beyond a single company. Customers worry about the safety of their funds, other exchanges review their own security, regulators ask fresh questions about oversight, and investigators face pressure to trace funds that can move quickly across borders and through a complex chain of wallets, mixers and exchanges. In this case, the scale of the reported loss has made the attribution question especially consequential, because the FBI is not merely describing a crime but linking it to a state.
North Korea Binance Hack: What Binance Disclosed
Binance disclosed on Friday that hackers had stolen more than $6 billion from the platform, an amount that, if confirmed in full, would make the incident the largest cryptocurrency heist on record. The disclosure immediately drew comparisons with previous large thefts in the sector, which have typically been measured in hundreds of millions of dollars rather than billions. A theft of this size raises questions not only about how the attackers gained access, but also about how such a large sum could be moved and whether any portion of it can be frozen or recovered before it is laundered beyond reach.
Details of the technical intrusion itself remain limited in public reporting. Binance has not, in the material cited for this story, provided a full account of the method used to breach its systems, and investigators have not published a detailed technical report that would allow independent experts to verify every step of the attack. That gap is common in the early days of a major incident, when an affected company and law enforcement agencies are still securing systems, preserving evidence and trying to prevent further losses. It also means that much of the public debate so far has focused on the attribution claim and the denial, rather than on a settled technical reconstruction of the hack.
The FBI Attribution to TraderTraitor
On 31 October, the FBI attributed the Binance theft to TraderTraitor, a hacking group that American investigators link to North Korea. According to the FBI’s assessment, as reported, TraderTraitor is the group responsible for the intrusion and the subsequent theft of funds. The bureau has previously associated the same group with another major cryptocurrency theft: the $1.5 billion theft from the exchange Bybit in February 2025. That earlier incident was already regarded at the time as one of the largest crypto thefts on record, and the alleged link to the same group is one reason investigators and analysts have treated the Binance case as part of a pattern rather than as an isolated incident.
The TraderTraitor name is used by American authorities and cybersecurity researchers to describe a cluster of activity believed to be connected to North Korea’s broader cyber operations. In past American statements, officials have described North Korea-linked hackers as using cryptocurrency theft to generate revenue, including funds that Washington says help support the country’s weapons programmes and evade international sanctions. North Korea has repeatedly denied such claims in the past, and Pyongyang’s latest statement follows that pattern of outright rejection. The dispute, therefore, is not only about a single theft but about a long-running disagreement over whether North Korea uses state-linked hacking as a source of income.
It is important to distinguish between an attribution and a proof that has been tested in court. An FBI attribution is a formal assessment by an American law enforcement agency, based on intelligence, technical indicators and investigative work that is not always made public in full. Such assessments carry weight because of the agency making them, but they are not the same as a criminal conviction, and the evidence behind them is often classified or sensitive. North Korea’s denial, by contrast, is a political statement from the accused state, not an independent technical rebuttal. Readers should therefore treat the two positions for what they are: opposing claims from interested parties, with independent verification still limited at this stage.
What Analysts Say About the Trail of Funds
Alongside the FBI’s attribution, private blockchain analysis firms have offered their own assessments of where the stolen funds went. Firms including Elliptic, Chainalysis and TRM Labs have traced movements of funds that they assess as linked to North Korea-linked actors, according to reporting of their work. Those assessments are based on analysis of public blockchain records, wallet patterns and transaction histories, which can reveal how funds move even when the identities behind individual wallets are not immediately known.
Those analyst findings should be read with the same care as the official attribution. Blockchain tracing can show that funds moved through particular wallets or services, and it can identify patterns that resemble earlier activity attributed to the same actors. It does not, on its own, prove who controlled a keyboard at the time of an intrusion, and different firms can reach different levels of confidence depending on the data available to them. The fact that multiple firms have pointed in a similar direction strengthens the FBI’s public case in the eyes of many observers, but it does not settle the matter beyond dispute, particularly when the accused state denies involvement and when full technical evidence has not been published.
Kim Yo Jong Denies Binance Hack and Accuses Washington of Provocation
Kim Yo Jong’s statement on 3 November went beyond a simple denial. By calling the FBI probe a trite provocation and its conclusions absurd rhetoric, she framed the attribution as a political act rather than a genuine investigative finding. Her accusation that the United States is trying to brand North Korea as a cyber criminal state reflects a broader North Korean complaint: that Washington uses cybercrime allegations to justify sanctions, pressure and isolation, regardless of the evidence. That framing is likely to resonate inside North Korea, where American statements are routinely presented as hostile acts, but it does not address the specific technical indicators cited by the FBI and by private analysts.
North Korea’s position also raises a practical question for investigators. When a state denies involvement and does not cooperate with an investigation, there is no straightforward route to test its denial through the courts or through access to its systems. American authorities can impose sanctions, issue indictments and share indicators with allies and with the private sector, but they cannot compel Pyongyang to open its networks to inspection. That limits the dispute to a contest of public claims, intelligence assessments and blockchain analysis, rather than a process in which both sides present evidence to a neutral arbiter.
Missile Test Reported the Day Before the Denial
The denial also came against a backdrop of heightened military activity. North Korea tested cruise missiles the day before the denial, according to reporting by Le Temps, a detail that has drawn attention because of its timing. The test itself is a separate event from the alleged hack, and there is no public claim that the two are directly connected. The timing, however, underscores the broader tensions surrounding North Korea at a moment when Washington is publicly accusing Pyongyang of a record-breaking theft and Pyongyang is responding with both a denial and a display of military capability.
At the same time, the coincidence of timing is likely to shape how the denial is received in Washington and in allied capitals. American officials who already regard North Korea as a persistent security challenge may view the missile test and the alleged hack as part of the same pattern of defiance. North Korean officials, by contrast, may present both the test and the denial as responses to what they describe as American hostility. That divergence in interpretation is itself a feature of the wider standoff, in which the same events are given very different meanings by each side.
What Remains Unknown and What Happens Next
Several central questions remain unanswered. The full method of the intrusion has not been publicly explained in detail, the total amount ultimately lost or recovered is not yet settled, and the attribution, while stated firmly by the FBI and supported in broad terms by private analysts, has been firmly denied by North Korea. Until more technical evidence is published or funds are traced to a point where they can be frozen and linked to identifiable actors, the public record will consist of competing claims rather than a conclusively proven account.
The next steps are likely to unfold on several tracks at once. Investigators will continue to trace funds and share indicators with exchanges and financial institutions, in the hope of intercepting money before it is fully laundered. Binance and other exchanges will face questions from customers and regulators about security controls, reserve practices and compensation, even though the details of any such arrangements have not been set out in the reporting cited here. Governments may consider further sanctions or law enforcement actions against individuals or entities they allege are involved, although such steps depend on identifying targets that can actually be reached by those measures.
For the cryptocurrency industry, the incident is a reminder of the scale of risk that remains even for the largest platforms. Exchanges hold vast sums on behalf of customers, they operate across many jurisdictions, and they are attractive targets for well-resourced attackers. Each major theft prompts a round of security reviews and calls for stronger controls, but the history of the sector shows that attackers adapt quickly. Whether the Binance case leads to lasting changes in how exchanges protect customer funds, or whether it is treated as an exceptional event, will depend in part on what investigators ultimately establish about how the theft happened and whether the funds can be recovered.
For now, the positions are clear and irreconcilable in public. The FBI says TraderTraitor, linked to North Korea, stole more than $6 billion from Binance in the largest cryptocurrency heist on record. Private analysts say their tracing points in a similar direction. North Korea, through Kim Yo Jong, says the claim is a provocation, the rhetoric is absurd, and the attempt to label it a cyber criminal state should be rejected. Until further evidence emerges, readers should hold both claims in view, recognise the limits of what has been published, and treat the attribution as an allegation that Pyongyang disputes, rather than as a settled fact agreed by all sides.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from The New Indian Express (https://www.newindianexpress.com/world/2026/Nov/03/fbi-probe-a-trite-provocation-north-korea-denies-involvement-in-binance-hack), Business Standard (https://www.business-standard.com/world-news/north-korea-denies-role-in-binance-crypto-heist-criticizes-fbi-probe-126110300081_1.html) and Business Today (https://www.businesstoday.in/amp/technology/news/story/north-korea-denies-role-in-6-3-billion-binance-hack-calls-claim-a-grave-political-provocation-565347-2026-11-03).