Kim Jong Un's Sister Denies North Korea Was Behind the $6.3 Billion Binance Hack

North Korea almost never denies a hack it's accused of. This week it did, and the denial landed the same day Binance published exactly how the largest crypto heist in history was pulled off.

THE DENIAL

Kim Yo Jong, the sister of North Korean leader Kim Jong Un, broke with Pyongyang's usual pattern of silence or tacit ownership. She denied U.S. accusations that her regime is behind the $6.4 billion Binance hack, calling the FBI's claims a political attack against her country. Her language was pointed: she called the FBI announcement "a trite provocation" and "an absurd rhetoric." She went further, arguing the pattern of blame itself was the problem, accusing Washington of linking North Korea to cybercrime cases around the world without evidence.

The FBI's attribution, which Kim was responding to, pointed to a familiar name. The FBI said the theft was orchestrated by North Korean hackers, attributing the attack to a hacking group known as TraderTraitor, which was also behind a $1.5 billion hack of the Bybit exchange last year. Blockchain analytics firm Elliptic did not back off that attribution after Kim's statement. Elliptic rejected Kim's denial, saying its investigation supports the FBI's attribution, telling CoinDesk that "the on-chain evidence links the $6.4 billion theft from Binance to the DPRK and Elliptic's analysis supports the FBI's attribution specifically to the North Korean state-linked group TraderTraitor."

Even the White House sounded less than fully convinced. Asked by reporters during a Halloween party at his Mar-a-Lago estate, Trump suggested investigators weren't yet certain North Korea was involved, saying "I'm not concerned. We're learning about it," and adding, "We don't know if it's North Korea," though saying investigators could still determine that it was.

HOW IT ACTUALLY HAPPENED, ACCORDING TO BINANCE

Separately from the attribution fight, Binance published its own account of the attack chain, and it reads like a slow-motion infiltration rather than a single breach. It started months before the theft. Preparations began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation to install a popular AI coding tool after searching for it on a search engine, according to a security report Binance published. Binance caught that intrusion and rotated credentials, but the damage of exposure was already done.

The second stage came through a fake job offer. In September 2026, the threat actor contacted another engineer through a legitimate job-hunting platform by disguising themselves as a project director. That contact escalated into a malware-laced coding assignment that compromised the engineer's work computer.

The final two stages moved fast once the groundwork was laid. On October 20, 2026, the attacker leveraged the compromised computer to abuse an internal AI tool and gain control over two more wallet engineers. Nine days later, the theft itself executed. On October 29, between 17:15 and 19:56, the attacker logged onto one engineer's computer, used credentials stolen from another, deployed a container, and triggered a malicious script to launch the attack. Binance said this kind of attempt is far from rare. The company estimated it had detected and prevented 57 suspected North Korea-linked cyber threat cases since the start of the year.

THE MONEY IS STILL MOVING

Binance has been racing to cover the damage while the attribution fight plays out. Co-CEO Richard Teng said Binance has replenished 98% of the $6.34 billion in affected assets and is still working to purchase the remaining, more illiquid tokens. Customer confidence has taken a visible hit regardless of who is ultimately proven responsible. Binance customers withdrew $10.97 billion in cryptocurrency over 46 hours after the hack, with withdrawals exceeding deposits by $5.28 billion, according to data shared by Teng.

Whether the TraderTraitor attribution holds up or not, the mechanics Binance disclosed are the part every exchange in the industry now has to defend against: a tampered download, a fake recruiter, and an internal AI tool turned against the company that built it.

This story comes from the Simply Bitcoin Live show. Watch the full episode.