Adversary Intelligence — 2026-11-12

North Korean Intelligence Officer Contradicts Pyongyang Denial, Says Reconnaissance Bureau Carried Out 6.43 Billion Binance Hack

BLUFOFAC will likely announce new sanctions designations tied to the October 29 Binance hack or its laundering by the end of December 2026, with the insider admission and $3.24 billion still in motion accelerating targeting of China-based facilitators.

Daily NK reported on Friday that a Reconnaissance and Intelligence General Bureau officer in Liaoning, China, told its source the Binance hack was "a job carried out by our side," while saying his own unit was not involved and he has not identified the responsible unit 1. The officer was not directly involved in the attack, and Daily NK says his remarks cannot prove North Korean responsibility 1. Kim Yo Jong denied the FBI's attribution of the October 29 theft to TraderTraitor in statements carried by KCNA and reported by Washington Post, CNBC and CoinDesk 234. Elliptic put the loss at $6.43 billion, of which about $2.85 billion has been frozen or seized 3. Chainalysis and TRM Labs separately attribute the hack to TraderTraitor with high confidence 5.

Analysis
The US Treasury (OFAC) will likely announce new sanctions designations explicitly tied to the October 29 Binance hack or its laundering by the end of December 2026. Confidence is low because no Treasury statement or public sign of a designation package exists, so the call rests on past practice against Lazarus-linked actors and the theft's scale. The officer's comment undermines Kim Yo Jong's denial but adds context rather than proof, since he was not involved and named no unit. It may also be inference from the route and method, which Binance's report and press coverage already circulate openly. The contradiction of Pyongyang rests on one anonymous Daily NK stream, though four outlets consistently report the denial and the FBI and analytics-firm attribution. His description of compartmentalized cells, with most overseas IT staff in China, points Washington toward China-based facilitators and over-the-counter brokers as targets. Roughly $3.24 billion remains in motion, so laundering exits will shape timing. Designations would force exchanges, brokers and banks in China and elsewhere to screen and cut off named entities and addresses. Without them, the burden stays on private freezes by Tether, Circle and exchanges, and Washington appears to be delaying action.

5 sources