North Korea Denies Binance Hack Allegations and Blames US
North Korea has dismissed US allegations that its hackers stole billions from Binance, with Kim Yo Jong blaming Washington for the security breach while Bitcoin prices reacted to the ongoing fallout.
On Tuesday, November 3, North Korea dismissed US allegations that its hackers made off with $6.3 billion from Binance, with Kim Yo Jong describing the FBI’s attribution as “absurd rhetoric” while implying that Washington itself might be behind the security breach.
The statement, disseminated via the state news agency KCNA, followed three days after the FBI identified TraderTraitor, a North Korean state-sponsored hacking collective, as the perpetrator.
NORTH KOREA SAYS CLAIMS THAT IT WAS BEHIND BINANCE HEIST IS "FABRICATION" – KCNA – RTRS
Advertisement
— Tree News (@TreeNewsFeed) November 2, 2026
This development changes little on the ground. Blockchain analytics firms Chainalysis, TRM Labs, and Elliptic had previously linked the theft to North Korea, and the illicit funds continue to move.
This ongoing movement is precisely why the situation remains critical for Bitcoin. Elliptic reports that $3.24 billion remains parked in wallets associated with the attackers—primarily held in Bitcoin and Ether—and observed the first tranche of stolen BTC moving through a mixer on Monday.
Bitcoin slipped 1.8% to $76,729 on the day, returning to its 200-day average, while the Crypto Fear & Greed Index fell from 37 to 26.
The key questions remain: what exactly did North Korea communicate, and how much of the stolen capital could still make its way into the broader market?
Market Intelligence: Crypto Analyst Predicts Best Low-Cap Crypto
Bitcoin News: What Did North Korea Say About the Binance Hack?
Pyramid claims that the US is fabricating the narrative and could potentially be the actual culprit. Kim Yo Jong, a senior ruling party official and sister of leader Kim Jong Un, outlined four principal points:
The claim: The FBI’s conclusion is characterized as “an absurd rhetoric and nothing new” alongside “a grave political provocation against the DPRK”;
The motive: The FBI is allegedly attempting to label North Korea as a “cyber criminal state” and pin global cybercrime on Pyongyang;
The counter-claim: Investigators should examine “who will get the large amount of the so-called stolen cryptocurrency” following its recovery, hinting that Washington could orchestrate the theft;
The warning: Pyongyang maintains “issues to reconsider” concerning the “very unpleasant US hostile attitude.”
She also rejected the FBI’s attribution of the $1.5 billion Bybit hack from February 2025, stating that the US “has attempted to spread misunderstanding of the DPRK.”
Such denials are routine. North Korea consistently refutes any involvement in cryptocurrency thefts, and the latest statement provided no evidence to support its accusations against the United States.
DISCOVER:Binance Hacker Sits on $1.4 Billion in Bitcoin, Triple a Week of ETF Buying, as Route 2 FI Buys the Dip
What Ties the Binance Hack to North Korea?
The FBI and three separate blockchain analytics firms have each established distinct investigative trails. The FBI stated on Saturday, November 1, that it tracked TraderTraitor converting stolen assets into ether and anticipates further laundering activities.
Private investigators point to similar conclusions:
TRM Labs: Attributes the attack to TraderTraitor “with high confidence,” pointing to attacker wallets funded via Tornado Cash and transaction signatures generated simultaneously in advance—both hallmarks of prior North Korean operations.
Chainalysis: Tracked upward of $500 million through intermediary Tron wallets prior to the initiation of a fresh laundering phase on Solana.
ZachXBT: Discovered funds from Binance and Bitget pooled at a shared address subsequent to transiting through THORChain.
Bitget: CEO Gracy Chen noted that preliminary findings linked IP addresses to VPN services utilized “by a certain DPRK group”.
None of these organizations have publicly released the off-chain intelligence underpinning their attributions, and no judicial body has issued a ruling on the matter.
Bitcoin News: Where Is the Stolen Money Now?
Roughly half of the capital remains under the hackers’ control. Elliptic’s updated figures calculate the total theft at $6.43 billion, slightly higher than the $6.3 billion cited in most reports.
Frozen or seized: $2.85 billion, representing 44%, which includes freezes implemented by Tether and Circle
Still in linked wallets: $3.24 billion, predominantly held in Bitcoin and ether
Swapped out of stablecoins: Approximately $786 million, converted into alternative assets such as ether prior to freezing actions
Mixed so far: Roughly 28 BTC, valued at approximately $2.2 million, distributed across 18 mixing transactions as of early Monday
The threat actors are operating at a slower pace compared to the aftermath of the Bybit incident, during which they liquidated all stolen ether within a ten-day window. Over the initial four days of the current event, they utilized approximately 12,000 wallets spanning 11 blockchains, introducing a new wallet every 25 seconds.
Elliptic anticipates that the remaining funds will be converted into Bitcoin over the coming months and subsequently liquidated through over-the-counter (OTC) brokers and exchanges. This represents $3.24 billion in prospective supply that could be gradually introduced into a market already gripped by fear.
EXPLORE:Crypto Hack Losses Hit $8.74 Billion in 2026, More Than Triple 2025, Yet Without Binance the Year Ran Quieter: How Did Bitcoin and Ethereum React After Major Hacks?
BTC Price Analysis: Can Bitcoin Hold Its 200-Day Average?
The cryptocurrency is hovering precisely at that threshold. BTC trades at $76,729 on Binance, marking a 24-hour decline of 1.8% after touching a low of $76,389 on Tuesday morning. The 200-day exponential moving average (EMA) sits at $76,502, positioned just above the post-hack low of $76,326 recorded on October 30.
That price floor has successfully held for five days, though rebound attempts have struggled; Monday’s upward push stalled at $78,878, falling well short of the 50-day EMA at $80,105.
BTCUSDT 1D chart. Source: TradingView
Resistance: $78,878 (Monday’s high), followed by $80,105 (the 50-day EMA) and $81,971 (the October 29 high registered prior to the hack)
Support: $76,502 to $76,326 (encompassing the 200-day EMA and post-hack low), followed by $74,968 (the September 15 low)
Outlook
Trigger
Level to watch
Rebound
A daily close above $78,878
$80,105, the 50-day EMA
Holding pattern
Holding between $76,326 and $78,878
Continued range trading while the attackers’ wallets remain inactive
Sell-off
A daily close below $76,326
$74,968, the September 15 low
In the broader context of Bitcoin news, North Korea’s denials alter nothing. The $3.24 billion remaining inside the hackers’ wallets does matter, however, and any early indicator of those funds moving toward exchanges would place intense pressure on the $76,326 support level.
Market Intelligence: Crypto Security Analyst Recommends Best Anonymous Crypto Wallets
