North Korea has rejected accusations that it was behind the $6.3 billion Binance hack, pushing back against the FBI's attribution of the theft as the exchange continues replacing assets and restoring withdrawals.
State news agency KCNA described claims linking Pyongyang to the heist as a fabrication, according to Reuters. Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a department director in the ruling Workers' Party, also attacked the U.S. accusation, calling it a political provocation and saying she would closely monitor the situation.
South Korean broadcaster SBS carried Kim's remarks in a fresh report. Yonhap separately reported her criticism of the FBI probe.
What investigators say happened
As previously reported by Apex, the FBI formally blamed North Korea in an October 31 alert, putting the theft at more than $6 billion in virtual assets taken from Binance on or around October 29. The bureau identifies the activity as TraderTraitor.
Its original alert describes investigators tracking the money after it left the exchange:
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ether (ETH).
The bureau said it expected further laundering through decentralized finance and instant-swap services. It published addresses holding, or previously used to hold, stolen assets and asked crypto businesses to block transactions involving those addresses or funds derived from them.
The appeal extends beyond centralized exchanges. It names THORNode operators, RPC node operators, decentralized-finance services, instant exchanges and blockchain analytics firms, reflecting the different routes investigators say the money could take.
Apex's earlier coverage also detailed separate assessments by TRM Labs and Chainalysis linking the attack to North Korean hackers. Chainalysis said funds stolen from Binance had mixed with proceeds from the earlier Bitget exploit. Those are the investigators' attribution assessments, which Pyongyang now contests.
The Secret Service has said its investigators worked with industry partners to freeze a significant portion of the stolen cryptocurrency within minutes of the attack. As covered in Apex's live report, the agency did not put a dollar figure on that portion or say the funds had been returned to Binance.
Binance is still sourcing the remaining tokens
While responsibility is being disputed, customers are dealing with the practical question of getting access to their assets. Binance's November 2 recovery update says approximately 95% of the impacted amount has been covered. The remaining 5% consists of less-liquid tokens that take longer to acquire at the scale required.
The company said it was continuing to work with industry partners on those purchases. It also planned the next phase of withdrawals for November 3, with details to follow once ready. That remains a planned rollout, rather than a promise that every remaining network will reopen at once.
Its position on who absorbs the loss was explicit:
Our commitment is unchanged: Binance will absorb the financial impact of the stolen funds, not our users.
The same update said users holding ten specified tokens could now verify that their balances were backed by at least one-to-one reserves in its October 31 snapshot. Another snapshot, covering more tokens, is planned for November 4; generating its full zero-knowledge proof is expected to take 40-50 hours.
Co-founder Changpeng Zhao added on November 2 that all replacement funds had been allocated, with the remaining work involving conversion into smaller coins. In a separate post, he said Binance had covered the loss from its balance sheet without borrowing or raising money.
The exchange has also warned that scammers are exploiting the phased reopening. Its latest security notice says it will not sell priority withdrawal processing, charge users to unlock assets or ask them to move funds into a supposed safe account.