A high-profile dispute has emerged over responsibility for the $6.3 billion Binance hack, after Kim Yo-jong, sister of North Korean leader Kim Jong Un, reportedly denounced the FBI’s probe as a “political provocation.” The Federal Bureau of Investigation publicly attributed the massive theft of virtual assets to North Korean activity identified as TraderTraitor, urging blockchain firms to block associated wallet addresses.
Conflicting statements over Binance hack
Binance stated its hot wallets were compromised on October 29, 2026, at around 20:05 UTC, resulting in estimated losses of $6.3 billion. The company pledged to cover these losses through its SAFU fund and corporate treasury without passing the shortfall to users. According to updates from Binance, about $3 billion in affected assets were quickly frozen on-chain, and initial analysis pointed to a compromised laptop as the likely entry point. Binance also reported uncovering further breach points, though it found no evidence that wallet private keys had been exposed.
Shortly after, the FBI traced the theft to North Korea, naming the TraderTraitor group and stating that the incident involved over $6 billion in digital assets. The agency called on blockchain services to block transactions linked to the listed wallet addresses. However, North Korean officials have rejected these claims. Reports from Yonhap News Agency and Reuters, cited by BeInCrypto, stated that Kim Yo-jong characterized the FBI probe as a provocation and that Pyongyang was monitoring the situation. North Korea’s state-run news agency labeled the allegations as fabricated.
TRM Labs and Chainalysis both linked the Binance attack to North Korean actors, but neither firm’s underlying forensic analysis was included in the published reports.
The FBI connected the TraderTraitor group not just to this hack but also to the $1.5 billion Bybit theft in 2025. Despite competing public statements, none of the information released by North Korea so far contains technical evidence to support its denial.
Unresolved questions and asset recovery
The full text and specifics of Kim Yo-jong’s remarks have not been published, nor has Pyongyang provided technical details challenging the FBI’s accusations. The FBI has not revised or withdrawn its conclusion from the October 31 alert. As a result, the competing claims remain unresolved.
The fate of the stolen assets also remains uncertain. On November 2, analysis from Elliptic indicated approximately $2.85 billion, around 44% of the hacked funds, had been frozen or seized, while $3.28 billion was dispersed across more than 950 wallets. These figures reflect the situation on that date and do not represent a final outcome. Elliptic also found no evidence that AI agents played a role in laundering the stolen assets.
Binance’s commitment to cover 95% of the affected amount refers to user compensation, not to the direct recovery of stolen cryptocurrency. The exchange published a zero-knowledge proof verifying 1:1 backing for ten specific assets, but this does not equate to retrieving stolen funds.
Despite Binance’s recovery efforts, there is no confirmation that the missing tokens have been returned to the exchange’s control.
Binance announced phased resumption of withdrawals as asset coverage neared 95%. Market data from CoinGecko on November 2 showed declines in Bitcoin, Ethereum, and BNB. Bitcoin was trading at $76,764 (down 1.14%), Ethereum at $2,250.03 (down 0.22%), and BNB at $697.04 (down 1.11%) over the previous 24 hours. The Crypto Fear & Greed Index measured sentiment at 37, classified as “Fear.”
Investor impact and security concerns
This incident has raised fresh concerns among cryptocurrency investors about centralized exchange security and the handling of digital assets during major breaches. Binance repeated its pledge to cover losses for its users, but there are ongoing questions about the effectiveness of recovery mechanisms and transparency across the sector.
As wallets linked to the stolen funds continue to be tracked and blocked, investors have looked for timely updates on asset movement and exchange operations. CryptoAppsy’s real-time charts and live news monitoring offer a streamlined way for affected users and market observers to follow transactions, track asset freezes, and stay informed during high-stakes incidents such as the Binance hack.
US law enforcement has continued to urge crypto platforms to block suspicious wallets, though the effect of these efforts on total asset recovery is still unknown. Market responses and public statements from all parties indicate that the situation remains unresolved and under active monitoring.
