South Korea delays Binance hack sanctions talks against North Korea

South Korea has yet to begin discussions on imposing additional sanctions against North Korea over its alleged involvement in the $6.3 billion Binance hack, although the country’s Foreign Ministry is reviewing measures targeting Pyongyang’s cyber activities.

Yonhap News Agency reported on November 5 that an official from the Unification Ministry said the government had not established the full circumstances of the October 29 cryptocurrency theft. The official explained that internal information-sharing would be necessary before authorities could begin discussing a response.

The statement followed a U.S. investigation attributing the attack to North Korean hackers, an accusation Pyongyang has rejected.

South Korea has not started Binance hack sanctions discussions

Speaking to reporters at the government complex in Seoul, the Unification Ministry official said authorities were still trying to determine what happened during the Binance security breach.

The official explained that discussions about how to respond had not started because the government lacked a complete understanding of the incident. Even internal consultations between relevant agencies had not reached the stage necessary to consider specific action.

The comments concern possible sanctions connected directly to the Binance attack. They do not mean South Korea has ruled out additional restrictions against North Korea or suspended its existing efforts to combat illicit cyber activity.

A separate position came from the Foreign Ministry, which confirmed that officials were examining several possible responses to North Korean cyber operations.

Ministry spokesperson Park Doo-soon said the review included unilateral cyber sanctions, although the government had made no decision on introducing them.

Park explained that Seoul was considering the issue alongside other serious matters involving North Korea. He did not announce a timetable for completing the review or identify individuals and organizations that might face restrictions.

The ministry’s comments leave the Binance-specific sanctions discussion at an early stage, while existing government work on cyber threats continues.

FBI links $6.3 billion Binance theft to North Korean hackers

The South Korean statements followed the FBI’s October 31 announcement identifying North Korea as responsible for stealing more than $6 billion in cryptocurrency from Binance.

In its security alert, the bureau attributed the October 29 attack to TraderTraitor, a North Korean hacking operation previously connected to major cryptocurrency thefts.

The FBI said investigators had observed the suspected attackers converting stolen assets primarily into Ethereum before preparing to move them through decentralized finance services and cryptocurrency exchanges.

American authorities subsequently urged blockchain infrastructure providers, exchanges and analytics companies to block transactions involving addresses associated with the stolen assets.

Separate blockchain investigations supported the U.S. attribution. As crypto.news previously reported, TRM Labs linked the attack to TraderTraitor with high confidence, although Binance had not independently identified the attackers.

Investigators have traced the funds across multiple blockchain networks while cryptocurrency issuers and security firms continue efforts to restrict transfers.

Binance’s own investigation into the breach identified compromised employee computers, malicious software and unauthorized access to internal wallet infrastructure.

The exchange said approximately $2.85 billion in affected cryptocurrency had been frozen or intercepted through cooperation with industry partners.

North Korea rejects FBI accusations over Binance theft

North Korea has denied responsibility for the attack, challenging the FBI’s findings and accusing Washington of using the incident for political purposes.

Kim Yo-jong, sister of North Korean leader Kim Jong-un and a senior Workers’ Party official, described the accusations as a “grave political provocation.”

Her November 3 response rejected the claim that North Korea had carried out the theft. The government has consistently disputed allegations linking its cyber operations to cryptocurrency attacks.

The North Korean denial followed the FBI’s public identification of TraderTraitor and its request for cryptocurrency service providers to restrict the movement of stolen funds.

Pyongyang later reiterated its rejection of the accusations while discussing the possibility of renewed dialogue with Washington.

On November 5, Unification Minister Chung Dong-young said North Korea appeared willing to consider talks with the United States if negotiations served its interests.

He noted that Pyongyang continued demanding changes to policies it considered hostile, including sanctions pressure, military exercises and human rights measures.

Seoul continues cyber cooperation with U.S. and Japan

Despite the absence of Binance-specific sanctions discussions, South Korea’s Foreign Ministry said international cooperation against North Korean cybercrime remained active.

Park confirmed that Seoul was working with Washington through bilateral groups and participating in trilateral arrangements involving Japan.

These mechanisms address illicit cyber operations involving North Korea and were already operating before the latest Binance incident.

Separately, Chung has opposed proposed sanctions against North Korea following a September 21 land mine explosion inside the Demilitarized Zone that injured three South Korean soldiers, two seriously.

Opposition politicians criticized his position as too accommodating toward Pyongyang. Chung argued that additional restrictions over the military incident would provoke North Korea without producing a positive result.