Pyongyang denies the largest crypto theft on record
The Federal Bureau of Investigation says [North Korea took more than $6 billion from Binance](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack). Kim Yo-jong answers that the accusation is a provocation, and asks who will keep the coins once they are frozen.
The Federal Bureau of Investigation attributes the theft of more than $6 billion in crypto assets from Binance to North Korea, the largest crypto heist on record. On Tuesday, Kim Yo-jong, the sister of Kim Jong-un and one of the most senior officials in Pyongyang, answered through the Korean Central News Agency with a phrase directed at the charge itself: “a grave political provocation against the DPRK.”
Her statement disputed the attribution and offered no evidence for its own account. Its argument concerned the other end of the case, the money: “As soon as the present U.S. administration took office last year, it announced that it would confiscate illegally stolen cryptocurrency assets and use them as a state’s strategic reserve.” Whoever ends up holding “the so-called stolen cryptocurrency” once it is retrieved, she added, “may get a clue about who is behind the hacking incident.”
The exchange describes the operation as a multi-stage campaign. In June, one engineer installed a tampered copy of an artificial intelligence (AI) coding tool, which exposed the wallet team to the attackers. In September, people posing as recruiters put a second engineer through fake job interviews and had him download a malicious “assignment” onto his work computer. From there the intruders used an internal AI tool to reach other engineers’ machines, and on October 29 they used that access to arrive at Binance’s wallet signing service.
The theft itself ran between 8:05 p.m. and 11:56 p.m. Coordinated Universal Time on October 29 and took $6.43 billion across 11 blockchains, by the count of the blockchain analytics firm Elliptic; the FBI sets the figure at more than $6 billion and publishes a list of addresses meant to let the industry block the money. Of the total, $3.46 billion, 54 percent, was in dollar stablecoins, the assets whose issuers hold the power to stop them. Tether froze its own stolen tokens 37 minutes after they arrived. Circle froze $823 million in its dollar coin before any of it had been swapped. In all, $2.85 billion has been frozen or seized, about 44 percent of the haul.
The 18,270 stolen bitcoin were split into 19 addresses in the same half hour and have not moved since. About $3.21 billion remains in addresses linked to the theft, mostly in ether and bitcoin, and the funds that have not moved are very likely still held by North Korea, Elliptic assesses, while the portion already in motion may sit with Chinese money-laundering networks that the country has used before. Most of what has moved, roughly $220 million in tron, went out through the Tron network, and at least $147 million has been bridged out of it, largely as ether. Almost all of the stolen solana, about $85 million, has been swapped, bridged or mixed, much of it ending as bitcoin, some of it through coinjoin mixing and a privacy pool.
Freezing 44 percent of a haul this size is unusual. After the $1.5 billion theft from Bybit in February 2025, roughly three percent was ever frozen, and the stolen ether took ten days to be laundered into bitcoin before a cash-out that lasted months. The difference here came in the first hour, when two private issuers with the technical power to freeze a token used it.
The theft is attributed. The coins are frozen. The argument is over who signs for them.
Attribution is the weak joint of the case, and the firm tracking the money says so in its own report. “When we say ‘the attacker,’ we mean whoever controls the wallets now holding the funds,” Elliptic writes. “The blockchain shows us those wallets, but not who is behind them.” The claim that Pyongyang is behind the theft is the bureau’s, made with the U.S. Secret Service and the criminal investigation arm of the Internal Revenue Service, which named the group TraderTraitor and asked exchanges, bridge operators, decentralized finance services and analytics firms to block the addresses. North Korea has been blamed for crypto thefts before and has denied involvement each time; it is rare for Kim to issue a statement on a hacking case at all.
What her statement does not supply is a document. The alert the FBI published is a call for the industry to block and trace the funds, and it says nothing about a reserve. The accusation that Washington wants the coins for itself is Kim’s, unverified and useful to her, and it does not touch the on-chain record of what left Binance in those four hours.
The question the case leaves open is who signs for the recovered money: the exchange that lost the coins, the two issuers that stopped them in transit, or the government that published the addresses and, in Kim’s reading, means to keep what it finds.