Mentioned in This Article
1. North Korea Hack Denial: What Kim Yo Jong Said
On November 2, 2026, Kim Yo Jong, a senior official of North Korea's ruling Workers' Party, rejected the FBI's conclusion that North Korean hackers stole more than $6 billion from the crypto exchange Binance. In a statement released through the country's state media, she urged the international community to consider who would end up holding the stolen assets once they are recovered, implying that Washington itself could be behind the theft. She supplied no evidence for the suggestion.
The statement is the first public response from Pyongyang to the incident. The remarks came two days after the FBI issued an alert tying the theft, which took place on or about October 29, to a North Korean hacking operation that the bureau tracks under the name TraderTraitor.
2. How Pyongyang Framed Its Rebuttal
Kim described the American position as "absurd rhetoric and nothing new." She went further, calling the practice of blaming North Korea for cybercrime around the world a "grave political provocation." The language follows a familiar pattern: North Korea has consistently rejected Western attributions of cyber operations, and its officials tend to answer such findings with political accusations rather than technical rebuttals.
The more unusual element of the statement was its argument about motive. Kim asked the international community to remember that the Trump administration, shortly after returning to office in 2025, announced a policy of seizing stolen cryptocurrency and holding it as a national strategic reserve. If officials examine who receives the very large amount of what she called "so-called stolen" crypto once it has been retrieved, she said, they "may get a clue about who is behind the hacking incident."
In other words, Pyongyang is proposing that the beneficiary of a recovery should be treated as a suspect. The claim is rhetorical rather than evidentiary. The statement did not point to any transaction, document or technical finding, and it did not engage with the blockchain analysis that had been published before the FBI's alert.
The timing is also notable. Pyongyang waited until after the FBI had published its alert and after analytics firms had publicly followed the money. By responding with a political argument rather than silence, the government chose to contest the narrative at the diplomatic level, even though the practical consequences of the attribution, such as address blocking and heightened monitoring by exchanges, proceed regardless of what it says.
3. What Did the FBI Conclude About the Binance Theft?
The FBI alert, dated October 31, 2026, attributed the Binance theft to North Korea and named TraderTraitor as the responsible cluster. The bureau said the hackers were converting most of the stolen assets mainly into ether (ETH), a pattern that matters for investigators because ether can be moved quickly through decentralized venues and bridges that have no central operator able to freeze funds.
The attribution did not come out of nowhere. Blockchain intelligence firms TRM Labs and Chainalysis had traced the movement of the stolen funds before the FBI issued its alert, and their onchain analysis pointed in the same direction. Kim's statement did not address that tracing.
Pyongyang has been accused of a string of exchange thefts in recent years. In February 2025 the FBI attributed a theft of roughly $1.5 billion from the exchange Bybit to North Korea and linked it to TraderTraitor as well. Kim's statement made a pointed reference to that earlier case, saying the United States had tried to place the blame on North Korea last year for the Bybit hack too.
TraderTraitor is the label the bureau uses for the North Korean cluster it holds responsible, the same one it linked to the Bybit theft in 2025. Tying two of the largest exchange thefts on record to a single named group is what gives the Binance attribution its weight, and it is the pattern Pyongyang is contesting.
4. Why Does the U.S. Crypto Reserve Enter the Argument?
The link Kim drew runs through an executive order that President Donald Trump signed on March 6, 2025. The order created a Strategic Bitcoin Reserve, to be funded with bitcoin (BTC) that the federal government has forfeited in criminal or civil cases or collected as civil penalties. A separate Digital Asset Stockpile holds other forfeited tokens, such as ether.
That second category is the one relevant to this case, because ether is the token the FBI says the Binance hackers have mostly been converting their loot into. If any of those funds were frozen or seized, forfeited ether would, under the order's structure, flow into the stockpile.
Kim's reading omits a significant provision. The order allows the attorney general or the head of another agency to return forfeited assets to "identifiable and verifiable victims of crime" instead of keeping them. In a case where an exchange and its customers are the victims, recovered funds could therefore be directed back toward them rather than retained by the government. Pyongyang's statement did not mention this mechanism, and it did not explain how a recovery that benefits victims would make the United States the author of the theft.
Understanding the policy helps explain why Kim chose it as a talking point. The reserve was presented as a way for the government to hold digital assets it has already taken control of, not to buy them on the open market. Critics of North Korea's argument would note that nothing in the order lets the government claim assets it has not lawfully forfeited, and that forfeiture generally requires legal process, whereas the attribution itself rests on investigation and tracing.
5. How Do Attribution Disputes Like This Usually Play Out?
Disputes over the origin of large crypto thefts follow a recognizable course. Investigators and analytics firms trace stolen funds across addresses and chains, compare the laundering patterns with those seen in earlier incidents, and then assign the activity to a named group. Governments attach their own intelligence to those findings, which is often not published. The accused state, in turn, denies involvement, and in most cases the dispute is never resolved in a courtroom.
For the crypto industry the practical significance of attribution lies less in the diplomatic argument than in the response it enables. An official finding allows exchanges, stablecoin issuers and other intermediaries to treat addresses linked to the group as high risk, to freeze funds when they can, and to refuse deposits that appear to come from the stolen pool. It also frames the incident as a matter of national security rather than ordinary theft.
That is why a public denial carries little weight with those who handle the funds. Compliance teams act on the traced addresses and the government's alert, not on a counter-narrative from the accused party. Kim's statement, which relies on speculation about motive, is aimed at an audience in the international political arena rather than at the firms that would have to decide whether to block a transaction.
There is also a structural reason these cases linger. Funds moved through mixers, bridges and swap services can be split into thousands of small transfers, and each hop adds jurisdictional complexity. Even when investigators are confident about who is responsible, recovering money depends on the cooperation of private companies in many countries, and that cooperation tends to be uneven.
6. Pyongyang's Closing Message
Toward the end of her statement, Kim said North Korea is "closely monitoring" American moves against it. She added that Pyongyang has "issues to reconsider in diverse aspects," without naming them. The remark was left deliberately vague, and it is unclear whether it refers to the response to the Binance allegations specifically or to Pyongyang's broader posture toward the United States.
Taken together, the statement does three things: it denies the charge, it reframes the debate around the reserve policy, and it signals that the dispute may feed into wider tensions. It does not change the underlying facts that the FBI and blockchain analysts laid out, namely the scale of the theft, the attribution to TraderTraitor and the conversion of proceeds into ether.
For readers following the market impact, the dispute adds a geopolitical layer to what began as a security incident at a single exchange. Traders and institutions typically watch such episodes for signs of further sanctions, new guidance to financial firms, or additional seizures, any of which could alter how stolen assets can be moved and how quickly they can be cashed out.
7. What Happens Next in the Binance Case
The central open question is how much of the stolen money can be recovered. The size of the theft, above $6 billion, makes it one of the largest in crypto history, and the answer will depend on how quickly the funds are moved and how many intermediaries are willing to freeze them. Any recovery would also test the reserve policy that Kim cited, since the rules on whether assets go back to victims or into the federal stockpile would be applied in practice for the first time on a case of this scale.
No date has been given for further public findings from the FBI, and Pyongyang has not said whether it will respond again. For now the exchange of statements leaves the attribution unchanged: American authorities hold North Korean hackers responsible, and North Korea says the accusation is political.
Observers will also watch whether other governments adopt the FBI's attribution. Allied agencies have in the past issued joint statements on North Korean crypto theft, and a coordinated position would add pressure on the intermediaries through which the funds are likely to pass. Whether that happens in this case has not been announced.