North Korea denies Binance hack after FBI names TraderTraitor: $3.24 billion of $6.43 billion still in theft-linked addresses

What Pyongyang said

Kim Yo Jong's statement responded to the FBI, which said on Saturday, 31 October, that North Korean hackers it tracks as TraderTraitor were responsible for the theft. Decrypt reports that the FBI's finding confirmed attributions made the previous week by blockchain analytics firms TRM Labs and Chainalysis, and that the US Secret Service has made the same attribution. The FBI blamed the same group for the $1.5 billion hack of Bybit in February 2025.

"The FBI is trying to brand the DPRK as a 'cyber criminal state'," Kim said, according to KCNA as quoted by CNBC. She accused Washington of misleading international opinion "as if all the cyber crimes in different parts of the world are our deeds", Decrypt reported, and called the accusation a "sinister" attempt to damage the country's image.

She also pointed back at the United States. Referring to the Trump administration's plan to hold confiscated crypto in a strategic reserve, Kim said that anyone who looks at who ends up with "the so-called stolen cryptocurrency" once it is retrieved "may get a clue about who is behind the hacking incident". North Korea has denied earlier hacking accusations, Decrypt noted.

Nothing in the statement offers evidence about the attack, and it does not affect the freezes, seizures or tracing work under way. For traders, its significance is limited to one point: there is no sign of cooperation that would return funds through diplomatic channels.

Where the $6.43 billion is now

The tracing figures come from two firms, measured at different times. Elliptic's numbers, published in a report on Monday and summarised by CNBC:

Sources: CNBC for the Elliptic figures; Decrypt for the Chainalysis figures.

Add the two Elliptic buckets and the arithmetic leaves a small remainder: $2.85 billion frozen + $3.24 billion still in place = $6.09 billion, about $340 million short of $6.43 billion. Elliptic said only a negligible amount appears to have been cashed out, with most of the activity being transfers or swaps between cryptocurrencies, so the gap is best read as funds in motion between chains rather than money already spent. The firms have not published a reconciliation, and we have not seen one.

SponsoredBybit

Partner rebate share30%Up to

Check regional eligibility and account terms

✓Code applied automatically by the sign-up link: 48553

Sign up on Bybit →Code48553Copied

Our earlier report covered the first CoinJoin transactions and the $3.24 billion still in place; see the 2 November Elliptic update. What is new since then is the official attribution, the denial and Chainalysis's view of how much has barely moved.

Why the laundering speed matters

Elliptic said the laundering is running slower than after the Bybit hack, when North Korean hackers moved all the stolen ether within 10 days. It expects the remaining funds to be converted gradually into bitcoin and potentially cashed out through over-the-counter brokers and exchanges over several months.

Two details explain why so much has been frozen this time. First, a large part of the haul was in stablecoins, and issuers including Tether and Circle froze what had not yet been swapped; the attackers converted roughly $786 million before that happened. Second, Decrypt compares the 44% frozen or seized with roughly 3% of the Bybit haul.

Chainalysis said the activity is broadly consistent with the "immediate layering" phase seen after earlier North Korean hacks, and that funds repeatedly returning to earlier addresses suggest automation. It expects the size of the theft to "strain the actors' trusted laundering channels", pushing funds toward bridges, instant exchanges and swapping services. CNBC reported that Chainalysis sees a new laundering phase after more than $500 million moved through intermediary wallets on Tron, and that the operation has since spread to other chains, including Solana.

For anyone who trades on smaller venues, that is the part to watch. Bridges and instant-swap services are where stolen coins meet ordinary users' deposits, and exchanges that receive flagged funds can freeze deposits while they investigate.

What Binance has said about customer funds

Binance said it has covered about 95% of the affected amount; the remaining 5% is made up of less liquid tokens that take longer to source, and it is working with industry partners to acquire them, CNBC reported. A separate report from Bloomberg Law, summarised by PANews, said the money used to make users whole came from part of the SAFU fund, part of the futures insurance fund and Binance's own corporate funds, and that Binance holds directors-and-officers insurance but, like other crypto firms, no cyber insurance. Insurance may cover only a small part of the loss. (PANews)

On flows, a Binance spokesperson told the BBC that a net $4.72 billion had been withdrawn since withdrawals resumed on Sunday, which the company called a "relatively limited portion" of about $157 billion in total assets, Decrypt reported. By 10 p.m. US Eastern time on Monday (11:00 SGT on Tuesday), hourly deposits were exceeding withdrawals, Binance said.

Binance also said users holding its 10 largest tokens, including BTC, ETH, USDT and USDC, can verify that their balances are fully backed using a zero-knowledge proof of its 31 October reserves snapshot, and that it plans a wider snapshot on Wednesday.

The $4.72 billion is a net figure measured by Binance. It is not an independent count, and it should not be mixed with the $6.43 billion stolen, which is a separate number from Elliptic.

What this means for you: what to check if you hold funds on Binance

1. Check your asset and network before sending. Binance is reopening withdrawals in phases. Before you move funds, open the withdrawal screen for the exact coin and network you plan to use. If the network is not available yet, a different network may be, but confirm the receiving address supports it.
2. Verify your own balance in the reserves proof. If you hold one of the 10 tokens covered by the 31 October snapshot, the zero-knowledge proof lets you check your balance yourself. A wider snapshot is due on Wednesday.
3. Ignore "compensation" messages. No legitimate process asks you to connect a wallet, share a seed phrase or send coins to receive a refund. Fake "Binance compensation" links and direct messages follow every large incident. Use only the app and the official site you already have bookmarked.
4. Expect deposit holds elsewhere. If you receive crypto from an unknown counterparty and deposit it on another exchange, the funds may be held for review if they trace back to flagged addresses.

Market context from our data pages

Large incidents tend to show up first in leveraged positioning. Our liquidations board tracks forced closures across the venues we observe, and the funding-rates board shows whether longs or shorts are paying to hold positions. Check both before adding leverage while withdrawal reopenings and laundering headlines are still moving the tape.

What to watch next

• Binance's wider reserves snapshot on Wednesday, 4 November.
• Whether the remaining 5% of less liquid tokens is sourced, and how.
• Further freezes as funds reach bridges and instant exchanges, which Chainalysis expects.
• Any US Treasury sanctions designations for addresses tied to TraderTraitor; none had been reported in the sources we opened.

Quick answers

Who does the FBI say hacked Binance?

The FBI said on 31 October that North Korean hackers it calls TraderTraitor were responsible, the same group it blamed for the February 2025 Bybit hack.

Did North Korea admit the Binance hack?

No. Kim Yo Jong called the FBI's attribution a "grave political provocation" in a statement carried by KCNA.

How much of the stolen Binance crypto has been frozen?

Elliptic says about $2.85 billion of $6.43 billion, or 44%, has been frozen or seized, with about $3.24 billion still in theft-linked addresses.

Are Binance withdrawals open?

Binance says it is reopening withdrawals for more assets and networks in phases, and that hourly deposits exceeded withdrawals by late Monday US time. Check the withdrawal screen for your specific coin and network.