Kim Yo-jong, the sister of North Korean leader Kim Jong-un and a senior official, has dismissed U.S. claims that Pyongyang orchestrated the largest cryptocurrency theft on record—an estimated $6.3 billion to $6.4 billion drain of Binance hot wallets on October 29, 2026.
In a statement carried by the Korean Central News Agency and reported by Yonhap News Agency, she described the Federal Bureau of Investigation’s attribution to the North Korea-linked group TraderTraitor as “absurd rhetoric” and a “grave political provocation.”
She accused Washington of seeking to brand the Democratic People’s Republic of Korea a “cyber criminal state” and of misleading international opinion by linking the regime to cyber incidents worldwide.
The denial followed the FBI’s weekend announcement identifying TraderTraitor—previously tied to other major crypto heists—as responsible, consistent with earlier assessments from blockchain analytics firms including TRM Labs, Chainalysis, and Elliptic.
The attack targeted Binance’s own signing infrastructure rather than private keys. Attackers drained hot wallets across multiple blockchains in roughly half an hour, with Elliptic estimating $6.43 billion across 11 chains and other firms placing the figure near $6.3–$6.36 billion.
Roughly $3 billion was later frozen by issuers and partners, though a large remainder in non-freezable assets such as Bitcoin and Ether remains under attacker control.
Binance has stated it will absorb all losses so that users are not affected and has drawn on corporate resources, a portion of its futures insurance fund, and part of its Secure Asset Fund for Users (SAFU).
On October 31, Binance transferred 7,499 BTC—valued at the time around $580 million—from the SAFU Bitcoin address as part of the replenishment.
This reduced the fund’s Bitcoin holdings by half, leaving a balance of roughly 7,500 BTC worth approximately $570–$580 million.
Binance’s own rules state that if the fund’s market value falls below $800 million due to Bitcoin price movements, it will rebalance the fund back toward $1 billion.
The current level sits below that threshold, yet the exchange has not announced a specific timeline for restoration, even as it has pledged to return SAFU to around $1 billion.
The deployment covered a portion of the shortfall while the company continues purchasing remaining affected tokens through market and over-the-counter channels.
Binance has published an updated proof-of-reserves snapshot taken at 00:00 UTC on October 31.
It confirmed that ten major tokens—Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD, and Zcash—are fully backed at least 1:1.
The corresponding zero-knowledge cryptographic proof was completed, enabling users holding those assets to independently verify that their balances are included in the reserves.
Coverage of the overall impacted amount reached about 95 percent by early November, with the remaining 5 percent consisting of less-liquid tokens still being acquired.
Withdrawals resumed in phases starting November 1 across multiple networks, including Bitcoin, Ethereum, BNB Chain, Solana, and others.
In the first several hours of the reopening, the exchange processed roughly $4.65 billion in withdrawals against about $1 billion in deposits.
As services restarted, Binance warned users of opportunistic scams. Impersonators have approached customers via direct messages, email, group chats, and even small transfers with attached messages, offering “priority processing,” compensation claims, or secure vaults in exchange for fees or signatures.
Co-CEO Richard Teng and official channels emphasized that Binance will never initiate contact about accounts, charge to accelerate withdrawals, request passwords, two-factor codes, or seed phrases, or direct users to unofficial proof-of-reserves sites.
The exchange advised reliance solely on official apps and verified channels.
Separately, Arbitrum’s Security Council recovered approximately $30 million in assets linked to the Binance exploit without the attacker’s private key. On October 30, the 12-member council—using emergency powers requiring nine signatures—temporarily upgraded the Inbox contract on Ethereum.
The new code included a function that allowed the council to send transactions that Arbitrum treated as originating from the exploiter’s address.
Two such transactions moved more than 8,425 ETH and about 74 million ARB tokens to a holding address ending in 0DA0; the original Inbox code was restored in the same atomic transaction.
The council stated that no other users’ funds or applications were affected and that the recovered assets can only be moved later through an ArbitrumDAO governance vote coordinated with relevant parties.
Security firm Zealynx traced the activity, confirming the funds arrived on Arbitrum shortly afterward as transactions with blank signature fields.
Tether announced that it froze more than $1.5 billion in stolen USDT within 30 minutes of the attack, preventing those tokens from being transferred, swapped, or laundered.
The statement followed the FBI’s attribution to North Korea and highlighted the issuer’s ability to blacklist addresses rapidly.
Other freezes, including by Circle, contributed to the roughly $3 billion total immobilized.
Elliptic’s later analysis found that stolen funds passed through approximately 12,000 wallets across 11 blockchains in under four days, generating more than 40,000 transactions—roughly one new wallet every 25 seconds in the early phase.
Tron served as a major conduit, with funds split across thousands of addresses and portions bridged onward.
About $3.24 billion remained in addresses linked to the theft (mostly Ether and Bitcoin), while roughly $2.85 billion was frozen or seized.
Elliptic assessed that only a negligible amount had likely been cashed out into fiat. Some Bitcoin began entering coinjoin mixing, but the bulk of the 18,270 BTC taken directly from Binance had not yet moved from its initial split.
On the XRP Ledger, Santiment reported nearly 8,000 new wallets created on November 1—one of the stronger daily totals of 2026—while the token’s price remained subdued near $1.25.
The analytics firm noted the timing after the Binance incident and suggested the increase could reflect a shift toward self-custody, though it stopped short of a definitive causal link.
Separately, the 233 million XRP stolen early in the attack later moved for the first time, splitting across six new addresses after remaining largely untouched for days.
Exchange flows shifted amid the fallout.
While Binance recorded substantial net outflows after withdrawals resumed—exceeding $7 billion in one reported period according to DefiLlama data—OKX led tracked venues with roughly $445 million in 24-hour net inflows.
The contrast illustrated users moving capital during the recovery window, even as Binance’s overall tracked holdings remained far larger than those of competitors.
An analysis by Vetle Lunde, head of research at K33 Research, estimated that Binance’s cumulative cost of regulatory fines and hack-related losses over the 2021–2025 period reached about $10.7 billion, equal to roughly 56 percent of an estimated $19.2 billion in pre-tax profits for those years.
Known fines totaled around $4.34 billion, dominated by the 2023 U.S. criminal settlement, while hack losses were put near $6.38 billion, including the recent incident and an earlier 2019 Bitcoin theft.
Lunde noted that about $3 billion from the latest hack remains frozen and that some recovery is still possible; he also observed that Binance’s tracked assets had fallen more than 11 percent since October 29, to around $128 billion.
Because the exchange has not published consolidated group financial statements, the figures remain estimates.
The analysis suggested that repeated fines, security incidents, and reduced asset scale could constrain investment capital as competitors expand.
The episode underscores both the scale of state-linked crypto theft and the industry’s rapid coordination on freezes, on-chain recovery tools, and transparency mechanisms.
Binance continues replenishing residual assets, users can now cryptographically verify major holdings, and investigators track a sprawling laundering trail that has so far yielded limited cash-outs. North Korea’s public rejection of responsibility leaves the attribution resting on U.S. government and private analytics assessments.
