Kim Yo Jong Challenges FBI’s North Korea Attribution in $6 Billion Binance Theft

Kim challenges U.S. attribution

Kim Yo Jong’s response to the FBI’s Binance theft alert centers on a question of who might ultimately control recovered crypto. The senior North Korean Workers’ Party official suggested that tracing the destination of the funds could reveal who was behind the hack, while rejecting Washington’s attribution of the attack to North Korea. She offered no evidence for the implication. That gap matters: a claim about who may benefit from recovered assets doesn't establish who carried out a theft, and the statement doesn't provide an independent account of the attack.

In a statement published by KCNA on Nov. 2, Kim described the U.S. position as “an absurd rhetoric and nothing new.” She called accusations that North Korea was responsible for cybercrime a “grave political provocation.” South Korean broadcaster SBS reported that it was Pyongyang’s first public comment on the incident. The language frames the dispute as a political confrontation, but it doesn't answer the operational questions at the heart of the FBI’s alert: how the assets were taken, where they moved, or what evidence supports the attribution.

Kim linked her claim to the Trump administration’s plans for a U.S. crypto reserve, saying it announced soon after taking office last year that seized cryptocurrency would be retained as a strategic reserve. “If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident,” she said. Her argument asks readers to scrutinize the possible destination of the money. It leaves unstated how that destination would identify the hackers, especially when the policy itself allows for more than one outcome.

Her statement did not address onchain tracing by TRM Labs and Chainalysis that preceded the FBI alert. That distinction is useful: blockchain tracing can track the movement of assets between addresses, while attribution to a particular actor requires additional analysis. The article provides no details about the firms’ findings, so their role here is limited to establishing that tracing preceded the bureau’s public notice.

The FBI’s attribution and earlier case

In an Oct. 31 alert, the FBI attributed the theft of more than $6 billion from Binance on or about Oct. 29 to North Korea. The agency tracks the activity as TraderTraitor and said the hackers were converting most of the stolen assets into ether. The alert therefore makes two distinct points: it assigns responsibility to a tracked activity and describes a reported movement in the stolen funds. Neither point, by itself, tells readers whether the assets can be recovered or who would ultimately receive them.

Kim also referred to the FBI’s attribution of the 2025 Bybit hack to North Korea. In February 2025, the bureau linked the roughly $1.5 billion theft to TraderTraitor, a claim Kim said Washington had made against her country the previous year. The earlier case gives context to her complaint that the United States repeatedly points to North Korea, but repetition doesn't settle the merits of either attribution. Each claim depends on the evidence associated with that incident, and the statement quoted here doesn't present a competing technical explanation.

What U.S. policy says about recovered assets

The executive order Donald Trump signed on March 6, 2025, directs bitcoin finally forfeited to the government through criminal or civil proceedings, or collected as civil penalties, into the Strategic Bitcoin Reserve. The order also allows the attorney general or another agency head to return forfeited assets to “identifiable and verifiable victims of crime.” Other forfeited tokens, including ether, are assigned to a separate Digital Asset Stockpile. Those categories matter because the FBI alert says the Binance hackers were converting most of the stolen assets into ether, while the reserve named in Kim’s argument concerns bitcoin.

The policy describes a process for assets that have been forfeited to the government; it doesn't say that every stolen token will be recovered, forfeited, or kept by the state. Returning assets to victims is expressly allowed under the order, and the route depends on the circumstances and decisions described there. Here's the thing: the existence of a reserve creates a reason to ask what happens to seized crypto, but it doesn't support a direct inference from government policy to responsibility for a hack.

Kim ended her statement by saying Pyongyang was “closely monitoring” U.S. actions and had “issues to reconsider in diverse aspects,” without specifying what those issues were. The reserve’s rules describe one possible path for forfeited assets; they do not establish that recovered Binance funds would automatically become government holdings. The warning is deliberately open ended. Any stronger reading would go beyond what she said.

Why the destination question matters

This is more significant than it looks because crypto thefts create two separate questions that can easily get blurred: who took the assets, and what happens if authorities later seize them. The first is an attribution question; the second concerns custody, forfeiture, and potential return to victims. A public policy governing the second doesn't answer the first. (And this is the part most people overlook.)

If you're working in this space, the distinction is practical: tracing a token’s movement may help investigators follow funds, while identifying a controller or linking activity to a state actor requires evidence beyond a destination address. The article offers no basis to assess the underlying technical case, and Kim's statement supplies no evidence for its own implication. That said, the policy question is still real for victims and exchanges: recovered assets can pass through legal processes before anyone knows who will receive them. A pointed accusation. An unanswered question.

Related Listen: Why the White House’s Hack-Back Memo Leaves North Korea Off the List