The FBI has officially identified North Korea as responsible for the $6 billion theft from Binance , an operation codenamed "TraderTraitor," and has provided the wallet addresses.
Trump: "It's not certain whether it was carried out by North Korea." He then added: If it is confirmed, the United States will "communicate" with North Korea .
One case has been closed, while the other is still under consideration.
The FBI does technical work.
On-chain addresses, money laundering paths, and infrastructure reuse—SlowMist traced the stolen TRX through the Bitget Wallet cross-chain bridge. The target address had been used by the Phemex hackers, and the Phemex hackers and Bybit attackers were the same Lazarus.
The chain of evidence is complete. The FBI's conclusion is the case's conclusion : who did it, where the money went, and which addresses should be blocked.
Trump is doing political work.
Once he personally confirms that "it is North Korea," this will no longer be the case of the $6 billion theft from Binance.
It will become a new variable in US policy toward North Korea .
The entities responsible for recovering the stolen assets have shifted from Binance's legal department to the Treasury Department's OFAC, the State Department, and even the military. Response options are extremely limited: sanctions? They've already reached their limit. Military options? Nobody wants to touch that. All that's left is "communication"—and "communication" requires a posture that doesn't feel like being forced to sit at the table .
So he said he was "uncertain".
The FBI is investigating a case. The president is settling accounts.
In August 2026, Trump was still publicly saying that he and Kim Jong-un had a “very good relationship” and that he was pushing for a face-to-face meeting with Kim Jong-un this fall, possibly as early as November .
The summit hasn't even started yet, so how can you expect him to personally confirm on November 1st that "North Korea attacked a US stock exchange"?
Confirmation would be too costly. Confirmation would mean taking action against North Korea before the summit, and Washington doesn't have many options.
Retaining "uncertainty" is not ignorance, but rather leaving room for diplomacy .
Whether the $6 billion can be recovered does not depend on how fast on-chain tracing works.
The FBI has already paved the way: THORNode operators, RPC nodes, DeFi protocols, instant exchange platforms—just block them, and that's it.
However, on-chain interception can only freeze the portion that hasn't been cleaned up yet. The real bulk of the problem requires national-level pressure to force North Korea to sit down. And the president's statements tell you: he doesn't want to play this card right now.
You think the $6 billion theft is a security incident in the crypto industry.
In Washington, it became a diplomatic bargaining chip .
The FBI has reached a conclusion. The president has left himself an out.
In the short term, $6 billion worth of crypto assets such as Bitcoin and Ethereum are still floating on the blockchain, and the money laundering channels have not been completely cut off.
In the medium term, as long as the "confirmation" step is stuck at the political level, there will be no full-scale intervention from national-level forces in the recovery of stolen assets .
This is not a problem that Binance alone can solve.
The FBI said: It's North Korea.
The president said: I'm not sure.
One speaks with evidence. The other speaks with consequences.
$6 billion is sitting on the blockchain, waiting for Washington to make a decision.
That decision had nothing to do with the speed of on-chain tracking. It was related to the cost of opening the box.