Trump Looks at North Korea Link to Binance Hack
President Donald Trump is looking at whether North Korea was behind Binance’s $6.3 billion hack, as US agencies investigate and private trackers point to a known Pyongyang unit.
Key Takeaways
- Trump says he is looking into the hack.
- Bloomberg: he is weighing a North Korea link.
- Chainalysis links the stolen funds to Bitget’s hack.
- Hack revives fight over crypto freeze powers.
Trump made the comment at a press conference on Friday, adding that Binance had said it was making sure customers get their funds back, The Block reported.
What Trump said
“But it’s a hack. That’s the problem,” he said, comparing crypto with the old way of signing a check: with crypto, he said, the money goes to people you never see, which is why he had always felt it was a little dangerous.
Bloomberg reported that he is also looking at whether North Korea was behind the attack, according to an Investing.com alert. The theft, which Binance has confirmed as the largest in crypto history, touches Trump in other ways too. Binance founder Changpeng Zhao pleaded guilty in 2023 to failing to maintain adequate anti-money-laundering controls as part of a $4 billion settlement, and Trump later pardoned him. And Trump-linked World Liberty Financial froze about $27 million of its USD1 stablecoin tied to the hack, Binance co-founder Yi He said, as Coindoo reported in its running coverage of the incident.
Who is saying what
The president is not the only one with a view on who did it, and the answers differ:
What the agencies have said
The FBI told Nextgov on October 30 that it was working with public and private partners to understand the scope of the incident, assess its potential impact and coordinate investigative steps. Nextgov noted that the bureau did not attribute the intrusion to North Korea.
The Secret Service described its own early-stage investigation. According to the BBC’s live coverage, the agency is working with private-sector partners to identify, freeze, trace and recover the stolen funds, and coordinating with the US Attorney’s Office for the District of Columbia. With two federal agencies and a federal prosecutor’s office involved, the case is being handled as a criminal matter as well as a security incident.
The Bitget connection
The new detail in the private attributions comes from Chainalysis. Besides pointing to TraderTraitor, the North Korean group that TRM Labs named with high confidence, it found that funds stolen from Binance mixed onchain with proceeds from last month’s Bitget theft, which had already been attributed to North Korean actors. Chainalysis says that overlap in the money trail strengthened its assessment.
Elliptic sees the same overlapping laundering infrastructure but adds that professional laundering networks often work for more than one client. Money from two thefts passing through the same channels shows they share a laundering route; it is weaker evidence that the same team broke into both exchanges.
A fight over who can freeze what
In Washington, the hack has reopened the debate over crypto rules. Commodity Futures Trading Commission Chair Michael Selig said on CNBC that the real problem is unregulated offshore exchanges without the safeguards of US markets, pointing to the framework his agency proposed on October 5 for leveraged retail crypto trading.
The sharpest exchange was over the Clarity Act, the broad market-structure bill that passed the House last year but has stalled in the Senate, partly over concerns about Trump’s crypto wealth:
Sen. Cynthia Lummis, R-Wyo.
The bill would have given crypto firms legal cover to freeze suspicious transactions the moment law enforcement calls.
↳ replied
Amanda Fischer, Better Markets
The bill would have required stablecoin issuers to freeze under a court order, and firms already froze assets as fast as they could.
↳ replied
Patrick Wilson, Solana Policy Institute
A section of the bill protected issuers from lawsuits over voluntary, temporary holds, with no court order needed.
Industry groups are pushing too. The Digital Chamber’s chief executive, Cody Carbone, wrote to House and Senate leaders on Friday urging them to pass a bill before Congress adjourns that would give the CFTC authority over crypto exchanges and keep customer funds separate from company funds in bankruptcy. Rep. Tom Timmons, R-S.C., framed the theft as a national security issue, warning against rogue regimes using digital assets to fund weapons programs.
What official attribution looked like last time
The Bybit case shows the form an official answer takes. The FBI’s notice named the country, named the activity and warned that the stolen assets were being laundered across thousands of addresses. No such notice has been published for Binance yet.
Still open
How did the attacker get in? Binance first pointed to a compromised engineer’s laptop. Co-CEO Richard Teng has since described additional breach points, according to the BBC, so the full technical account is still to come.
How much comes back? About $3 billion has been frozen, but frozen funds are not yet returned funds, and the attacker has been converting freezable stablecoins into assets such as ETH, as Coindoo traced in its look at how the hacker borrowed against stolen USDT.
This article is provided for informational purposes only and does not constitute financial or investment advice.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
