ع
Kim Yo Jong the sister of North Korean leader Kim Jong Un dismissed accusations that her country was behind the theft from the cryptocurrency exchange as absurd rhetoric in a statement carried by the Korean Central News Agency. “It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds” she said. The comments mark Pyongyang’s first public response to the FBI’s attribution of the October 29 breach to the TraderTraitor hacking unit which Washington has also blamed for a string of prior digital asset thefts.
According to Reuters Kim accused Washington of trying to brand the DPRK as a cyber criminal state while repeating a pattern of linking Pyongyang to every major cyber incident. The FBI the Secret Service and analysts from TRM Labs Chainalysis and Elliptic had all pointed to North Korean actors in the days after the attack which Binance initially traced to a compromised engineer laptop. The exchange reported that most of the funds were drained within the first 20 minutes of unauthorised access.
Elliptic data shows the perpetrators routed the stolen assets through roughly 12000 wallets and over 40000 transactions spanning 11 blockchains in the initial laundering phase. The firm placed the exact loss at $6.43 billion of which about $2.85 billion or 44 percent has since been frozen or seized by authorities. Roughly $3.24 billion remains in linked addresses predominantly denominated in bitcoin and ether.
Binance co-CEO stated that net outflows have since normalised with hourly deposits exceeding withdrawals and that the platform maintains very strong financial health. The company replenished approximately 95 percent of the impacted customer assets from its own reserves while launching a user reassurance campaign and broadening withdrawal options. Its proof-of-reserves update aimed to restore confidence following the record breach.
Blockchain analytics firm Elliptic estimates that North Korean-linked actors have stolen cryptocurrency worth $7.6 billion so far in 2026 exceeding any prior full-year total. Cumulative proceeds attributed to such groups since 2017 now stand at more than $11.8 billion according to TechFlow statistics that draw on multiple forensic reports. A UN panel of experts has previously assessed that these operations supply a substantial share of Pyongyang’s foreign currency revenue which in turn supports its weapons programmes.
The TraderTraitor group also referred to as Lazarus has been tied to earlier landmark exploits including the $1.5 billion Bybit theft in February 2025 and the $620 million Ronin Bridge attack in 2022. FBI communications have urged exchanges and blockchain services to block transactions involving identified wallets tied to the latest incident. Researchers note that the organisation has refined its tactics to incorporate more complex mixing services and cross-chain movements that complicate recovery efforts.
