President Donald Trump said the United States is examining who was behind the record theft from Binance, while making clear that Washington has not determined whether North Korea was responsible. Asked in the Oval Office on October 30 whether the attack should be attributed to a North Korean hacking group, Trump replied that the U.S. did not know and was looking at the matter. His brief answer adds presidential attention to the incident, but it does not amount to a formal attribution, a law-enforcement finding or an announcement of executive action.

A review, not an attribution

The distinction matters because several different claims are circulating around the attack. Trump addressed a reporter's attribution question and said the government was reviewing it. He did not identify the agency leading that work, describe its scope or provide a timetable. The Hill and The Block separately reported the remarks, while a direct event transcript records the same exchange. None of those accounts establishes that the U.S. government has assigned responsibility. A reported review can involve intelligence, diplomatic and law-enforcement channels without producing an immediate public conclusion.

Related reporting: Trump Says US Is Looking Into Binance Hack, Leaves North Korea Question Open

Private intelligence assessments remain separate

TRM Labs has attributed the theft with high confidence to TraderTraitor, a North Korean state-sponsored unit, based on what it describes as onchain and offchain intelligence. The firm says approximately $6.36 billion moved from Binance wallets across ten blockchains, mostly during a short window on October 29. That is a private-sector assessment, not a U.S. government attribution. Binance has also not publicly named the attacker. Its investigation has evolved from an initial suspected laptop compromise to additional breach points, leaving the final technical account unfinished.

Law-enforcement involvement is partly reported

Reuters reported on October 30, citing a person familiar with the situation, that Binance was working with the FBI and U.S. Secret Service alongside other authorities. The agencies did not publicly confirm an attribution in that report. Cooperation with investigators can support tracing, preservation requests and potential seizures, but it does not prove that recoverable assets have been located or that a case has reached an enforcement stage. Readers should separate agency participation reported through an unnamed source from an attributable government announcement.

Coverage is not the same as recovery

Trump also referred to Binance saying that it would make customers whole and that the situation was under control, while adding that the outcome remained to be seen. Binance's latest company update says it has covered 90% of the stolen amount with replacement assets and continues sourcing the remaining, less-liquid tokens. That figure describes internal replenishment, not the return of 90% of the stolen funds. The exchange also says withdrawals remain targeted for November 1 and that full cryptographic proof for its October 31 reserve snapshot is still being generated.

What comes next

The most consequential next evidence would be an attributable U.S. agency statement, charges or sanctions, a Binance technical report connecting the intrusion path to the unauthorized transactions, and documented recovery of identified assets. Until then, the public record supports three narrower conclusions: the president says the U.S. is looking at attribution, private firms point to North Korea, and Binance says it is replacing losses while its operational restoration continues. Treating any one of those statements as proof of the others would overstate what has been established.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.