Key Takeaways
- • North Korea's Kim Yo Jong rejected the FBI's attribution of the approximately $6.3 billion Binance hack to the North Korea-linked group TraderTraitor, calling the accusations a political provocation (per Yonhap and KCNA, November 3).
- • Kim Yo Jong suggested the United States itself could be involved, pointing to Washington's plans to confiscate illegally obtained crypto assets for a national strategic reserve, but provided no evidence.
- • The FBI, on October 31, published hundreds of cryptocurrency addresses tied to the attackers and urged industry participants to block associated transactions; the stolen assets were primarily converted into Ethereum.
- • South Korea's Financial Services Commission held an emergency meeting on November 2 urging local exchanges to raise cold-wallet holdings and tighten withdrawal controls, building on an existing 80% cold-storage requirement.
Summary
North Korea has rejected the conclusions of the U.S. Federal Bureau of Investigation that the hacker group TraderTraitor, linked to Pyongyang, carried out the theft of cryptocurrencies from Binance valued at approximately $6.3 billion. Kim Yo Jong, sister of North Korean leader Kim Jong Un, characterized the accusations as a political provocation, according to Yonhap. In a statement released through the state agency KCNA on November 3, she accused Washington of portraying North Korea as a state engaged in international cybercrime, arguing that the U.S. routinely links Pyongyang to major hacks to damage its image.
According to Reuters, Kim Yo Jong also suggested the United States itself might be involved in the theft, pointing to the American administration's plans to confiscate illegally obtained crypto assets and allocate them to the national strategic reserve. She proposed examining who would benefit from the return of the stolen funds, arguing this could reveal the organizers of the attack. She did not provide evidence of U.S. involvement.
The FBI stated on October 31 that the attack was carried out by TraderTraitor, published hundreds of cryptocurrency addresses used by the perpetrators, and urged industry participants to block transactions linked to them. According to the agency, the attackers converted the stolen assets primarily into Ethereum, and it expects further laundering through DeFi protocols and instant cryptocurrency exchange services.
Separately, South Korea's Financial Services Commission (FSC) held an emergency meeting on November 2 with the Financial Supervisory Service, the Financial Security Institute, the DAXA exchange alliance and major local platforms. Regulators urged exchanges to increase the share of assets held in cold wallets, enhance control over fund withdrawals, and review access controls, administrator rights, transaction signing and withdrawal approval procedures. The FSC also recommended additional incident-response staffing, faster sharing of information on suspicious access attempts, and extra reserves against potential losses. South Korea already requires at least 80% of client crypto assets to be held in cold wallets by value, a rule effective July 2024 under the Virtual Asset User Protection Act. The episode has also reignited debate over the rules governing how stablecoin issuers block stolen assets.
According to Reuters, Kim Yo Jong also suggested the United States itself might be involved in the theft, pointing to the American administration's plans to confiscate illegally obtained crypto assets and allocate them to the national strategic reserve. She proposed examining who would benefit from the return of the stolen funds, arguing this could reveal the organizers of the attack. She did not provide evidence of U.S. involvement.
The FBI stated on October 31 that the attack was carried out by TraderTraitor, published hundreds of cryptocurrency addresses used by the perpetrators, and urged industry participants to block transactions linked to them. According to the agency, the attackers converted the stolen assets primarily into Ethereum, and it expects further laundering through DeFi protocols and instant cryptocurrency exchange services.
Separately, South Korea's Financial Services Commission (FSC) held an emergency meeting on November 2 with the Financial Supervisory Service, the Financial Security Institute, the DAXA exchange alliance and major local platforms. Regulators urged exchanges to increase the share of assets held in cold wallets, enhance control over fund withdrawals, and review access controls, administrator rights, transaction signing and withdrawal approval procedures. The FSC also recommended additional incident-response staffing, faster sharing of information on suspicious access attempts, and extra reserves against potential losses. South Korea already requires at least 80% of client crypto assets to be held in cold wallets by value, a rule effective July 2024 under the Virtual Asset User Protection Act. The episode has also reignited debate over the rules governing how stablecoin issuers block stolen assets.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.