After Binance was hacked for $6.3 billion, it alarmed Trump and Kim Jong-un.

Unexpectedly, the $6.3 billion Binance hack has somehow escalated to this point.

On the evening of October 31, at the Halloween party at Mar-a-Lago, a reporter asked Trump what he thought about the Binance hack. He said: "We don't know if it's North Korea. But if it is, we'll talk to North Korea."

On the same day, in Pyongyang, Kim Jong Un's sister Kim Yo Jong issued a statement calling the U.S. allegation "a serious political provocation against North Korea."

What started as a matter for one trading platform is now clearly no longer just a matter for one trading platform.

Trump's business connections

First, look at the U.S.

On the same day Trump said "we don't know if it's North Korea," the FBI had already issued a cyber advisory. The advisory contained a codename: TraderTraitor, the name the U.S. government gave to a subunit of the North Korean hacking group Lazarus.

In other words, U.S. law enforcement had already named names, while the U.S. president said he didn't know.

One must learn from a businessman's shrewdness.

This is rare in the history of the crypto industry. The standard procedure for such matters used to be: the FBI issues an advisory, the Justice Department indicts a few names, and the Treasury Department adds addresses to the sanctions list. The president doesn't get involved.

This time, the president got involved. Tactful, and leaving room for maneuver.

Why leave room? There are at least two reasons.

The first is diplomacy. Trump has always wanted to restart summit talks with North Korea and has repeatedly extended olive branches to Pyongyang. If the president personally pinned this heist on North Korea, that door would be very hard to open again.

The second is money.

In 2025, Abu Dhabi's MGX invested $2 billion in Binance. This money was not paid in U.S. dollars, nor in USDT, but in USD1.

USD1 is a stablecoin issued by World Liberty Financial, a project in which the Trump family is deeply involved. Just before Trump took office in January 2025, an entity backed by UAE National Security Adviser Sheikh Tahnoon spent $500 million to buy 49% of World Liberty's shares. According to public reports, the Trump family receives a revenue share from this company.

So, Trump and Binance are strongly connected. Trump does not directly hold Binance. But the $2 billion Binance received was paid using his family company's stablecoin.

After Binance was hacked, World Liberty was also on the list for emergency freezing of stolen funds: it froze $27.8 million in USD1 and $2 million in WLFI.

Trump's assets are also strongly connected in this case.

So while Trump was celebrating and chatting briefly about Binance, it seemed casual, but the listener took it seriously.

Pyongyang was the listener.

North Korea's Top Leadership Responds for the First Time

On November 2, Kim Yo Jong issued a statement. The next day, KCNA published it.

The speaker was not a Foreign Ministry spokesperson. It was Kim Yo Jong, department director of the Central Committee of the Workers' Party of Korea, and Kim Jong Un's sister.

She said the FBI's claim that a so-called North Korean "supported" hacker group was involved in the multibillion-dollar Binance theft was an attempt to smear North Korea as a "cybercrime state."

"This is a serious political provocation against North Korea."

"The U.S. misleading international public opinion is an infringement that tarnishes North Korea's international image."

She also said North Korea is closely monitoring various U.S. provocative acts and, given the U.S.'s hostile attitude, will "reconsider" some issues.

Whether North Korea denies it or not is not important; what matters is who is speaking.

Kim Yo Jong is one of the few people in North Korea who can speak directly on behalf of the top leadership. Her past public statements have basically fallen under three topics: inter-Korean relations, U.S.-South Korea military exercises, and messages to Washington. In August 2025, she called South Korean President Lee Jae-myung's dialogue proposal a "daydream" and also said North Korea "will never again sit face to face with the United States."

None of these statements was about a specific cyberattack, let alone cryptocurrency.

North Korea has a tradition of denying such allegations. On May 3 this year, the Foreign Ministry published an article through KCNA calling U.S. allegations about North Korean cybercrime and crypto theft "absurd slander." But that was the Foreign Ministry, and its words could be treated as diplomatic rhetoric.

So this is not the first time North Korea has denied it. This is the first time Kim Yo Jong has denied it.

An official from South Korea's Ministry of Unification put it bluntly: this is the first time Kim Yo-jong has spoken out about allegations of North Korean cyber hacking; in the past, similar situations were usually handled by the Foreign Ministry. North Korea considers this matter serious, so it "raised the response level."

And in Kim Yo-jong's view, this naming has a backstory.

She dug up an old matter: after the current U.S. administration took office, it announced that illegally stolen crypto assets would be confiscated and used as the country's strategic reserve. Then she said: once these "so-called stolen cryptocurrencies" are recovered, see whose hands they end up in, "perhaps then it will be clear who is behind this hacking incident."

The subtext is that the U.S. staged this itself.

Compared with the sarcasm from Zhao Changpeng and Musk, Trump and Kim Yo-jong are clearly more fired up. With the midterm elections coming soon, it's unclear whether Trump will still make something of it.

How a country builds hackers

Of course, Kim Yo-jong's denial is one thing; whether to believe it is another.

After all, the notoriety of North Korean hackers has even been made into documentaries. Because they are simply too good at hacking. A data analytics firm gave a figure: from 2021 to the end of October this year, in the crypto world alone, $13.2 billion has been identified as linked to North Korea.

A country that doesn't even have enough electricity has obtained more than $10 billion through hackers. Who wouldn't be curious about how these hackers are trained?

In 2025, a director made a documentary, "How North Korean Hackers Are Stealing Billions." It devotes a large portion of its length to answering exactly this question.

The documentary's story begins with a boy.

In mid-1990s North Korea. He remembers the day the rice in the village ran out, remembers catching dragonflies to stave off hunger in summer, and knew early on that rescue would not come. But he had one gift: numbers came easily to him. He kept his head down studying, scored full marks in everything, and waited.

One day, a government official came to his school and looked through the list of top students. He was selected for a special education program with advanced mathematics courses. At age 12, he went abroad to compete in the International Mathematical Olympiad. It was a brief chance to see the outside world.

Back in North Korea, he began intensive training in computer science and was sent to a top university in Pyongyang to study programming, encryption, and cybersecurity. Tens of thousands of gifted children across the country walked the same path, and only a very few could pass the final selection. The smartest and most loyal ones would be sent to one of two places: the nuclear weapons program, or the cyber force.

He was selected for the latter and stationed in another country.

After entering the system, he was treated as a soldier. He and a group of similar young men were crammed into a small apartment, their movements under strict surveillance. They were woken at 6 a.m. and worked 15 to 20 hours a day. Like others in his unit, he had to steal at least $10,000 a year, almost all of which was handed over, leaving only enough to survive.

In the documentary, a former North Korean computer science professor who defected to South Korea said there are about 6,000 such "cyber warriors" in North Korea. His assessment of this force was just one sentence:

"For North Korea, the cyber unit is the most important because it is asymmetric. It can achieve enormous results with very few people and very little equipment."

$10,000 a year. That number turns an intelligence agency into a sales team. It has KPIs, assessments, eliminations, and promotion channels. It even solves the hardest problem in North Korean society: birth determines everything; but if you excel in sports, arts, or computers, you can move up. Being a hacker is hard and morally dubious, but it can earn better rations, better housing, and even let your family move to a better neighborhood in Pyongyang.

Those selected are indeed their geniuses, but once selected, they have no choice either.

Lax Standards

The Korean Central News Agency, the official North Korean news agency — the same media outlet that today published Kim Yo Jong's response to Trump — has an official website.

Any website needs a set of software to run, just as a house needs doors and locks. Software becomes outdated, and when it does, vulnerabilities appear — equivalent to a broken lock that anyone can pick open with a piece of wire. So normal websites update regularly, changing to new locks.

The newest component of the software used by the KCNA website dates from 2016, and the oldest from 2013 — long unmaintained. In other words, the lock on this door was publicly declared "broken" over a decade ago.

A country that can steal over $10 billion from trading platforms around the world has had problems with its own official website for over a decade — and hasn't fixed them.

Just this October, a severe vulnerability was exposed worldwide: a commonly used website software could be exploited to directly take control of an entire server with a single specially crafted request. Websites around the world patched overnight. The version used by the KCNA website was right there on the affected list.

Everyone said this was the most serious bug in internet history — please upgrade as soon as possible.

Just like that, to this day, KCNA still hasn't corrected it.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia