Talk to a security expertFree technical auditFree audit

Insight

North Korea denies the FBI's TraderTraitor attribution. For defenders, the useful question is what the public evidence can actually support.

By Riftweld Labs

Insights6 min read

In this analysis

What happened.

On 29 October 2026, Binance suffered a $6.4 billion theft. The FBI attributed it to TraderTraitor, a North Korean hacking operation, and asked cryptocurrency services to block wallet addresses tied to the stolen funds. CoinDesk reported the attribution and the blocking request on 31 October.

Kim Yo Jong, the sister of North Korea's leader, denied the accusation. In a statement published by state news agency KCNA, she called the U.S. claim a political provocation and said Washington blames North Korea whenever a major cybercrime occurs.

The denial is a political statement. The FBI alert is a law-enforcement attribution. Neither is a complete forensic report, and the public record still has gaps that matter to anyone defending a crypto service.

What the record supports.

Several claims are supported by the reporting, even if the full evidence is not public.

The FBI tied the theft to TraderTraitor and published addresses. Its 31 October alert identifies wallet addresses it says are controlled by or connected to North Korean hackers, and asks exchanges and blockchain services to block transactions involving them. That is an actionable signal, separate from the wider attribution debate.

Elliptic says its analysis supports the attribution. The firm told CoinDesk that the on-chain evidence links the theft to the DPRK and supports the FBI's specific attribution to TraderTraitor. Elliptic also said $2.85 billion of the stolen funds has been frozen or seized, while investigators continue tracking the rest.

Investigators have linked the theft to Lazarus Group. Blockchain investigators connected the Binance hack to North Korea's Lazarus Group. That is consistent with the TraderTraitor attribution, but the public material does not explain the exact relationship between the two labels.

The laundering appears automated, but not necessarily AI-directed. Elliptic traced stolen funds through thousands of wallets and found evidence of automated laundering. It found no proof that AI agents were directing the transactions.

There is a cross-case signal. AMLBot's Vasily Vidmanov pointed to stolen funds from the Binance and Bitget hacks converging in common wallets. He told CoinDesk: “Onchain analysis can link wallets to one actor. It can’t prove nationality or state sponsorship.” The convergence is useful evidence. It is not, on its own, a state-sponsorship proof.

Protocol-level intervention is now part of the picture. CoinDesk reported that Arbitrum's council moved $30 million of Binance hack funds without the hacker's key. The public material does not explain the mechanism, authorization or legal basis, so defenders should not assume this kind of intervention is routine.

What it does not prove.

The public record is thinner than the headline number suggests. These are the main gaps.

  • It does not prove nationality. On-chain analysis can link wallets to an actor. It cannot, by itself, prove who controlled that actor or which state sponsored it. The attribution is cumulative: wallet clustering, laundering patterns, prior infrastructure, sanctions history and intelligence.
  • It does not establish the initial access vector. The public reporting does not say how the 29 October compromise happened, which systems were affected, or whether it involved a smart contract, key management, a signing process or an operational compromise.
  • It is not the full FBI forensic package. The FBI has not released its complete findings, including the reasoning that connects the published addresses to North Korean operators.
  • It does not prove AI involvement. Automated laundering is not the same as AI-directed laundering. Elliptic found the former and not the latter.
  • It does not quantify the loss to users. The public material gives the headline theft and the amount frozen or seized. It does not set out customer losses, insurance recovery or reserve impacts.
  • It does not resolve the Arbitrum mechanism. The reported $30 million movement without the hacker's key raises governance, legal and operational questions that the public record does not answer.

What defenders should do.

Attribution debates are useful context. They are not a control set. These are the practical actions that follow from the record.

  1. 01Use the published addresses, not the narrative.

    Block the addresses in the FBI alert and track them across chains. Treat the attribution as a lead that may change, not as a fact that closes the investigation.

  2. 02Watch the exit, not just the entry.

    The most useful evidence is what happens to the money next: swaps into bitcoin, OTC broker transfers and movement through exchanges. Monitor those routes and share indicators with peers.

  3. 03Check cross-case convergence.

    If the same wallets appear in the Binance and Bitget flows, that is an attribution-strengthening signal. It is also a detection opportunity: one wallet cluster can connect two incidents.

  4. 04Do not over-index on the AI story.

    Automated laundering is real. AI-directed laundering is not established in the public record. Build detections around observed behavior, not an unproven agent hypothesis.

  5. 05Prepare for protocol-level action.

    Governance bodies can move or freeze assets in ways that sit outside normal incident-response playbooks. Know who can act, on what authority, and how you would verify a legitimate intervention.

Method and limits.

This analysis draws on CoinDesk's reporting and the sources it links, including the FBI alert, Elliptic's comments, KCNA's publication of Kim Yo Jong's statement, and prior U.S. Treasury and Justice Department actions. It is an analysis of the public record, not an independent on-chain investigation.

Riftweld did not verify the wallet attribution, the frozen amount or the Lazarus link against raw blockchain data. Where the record is incomplete, we have said so rather than filling the gap.

Sources.

Keep reading.

Everything from Labs

Adversary simulation

Prove the route before someone else does.

We reproduce the path an attacker would take, show the impact with evidence, then retest after the fix.

Scope an engagementStart with a free audit