North Korea denies role in $6.3B Binance hack, points finger at US
Pyongyang has pushed back against the FBI’s attribution of the Binance attack, with Kim Yo Jong calling the US allegations politically motivated.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied North Korea’s involvement in the $6.3 billion Binance hack and appeared to suggest, without evidence, that the US could have been behind the theft.
In a statement released via the Korean Central News Agency (KCNA) on Tuesday, Kim rejected the FBI’s attribution of the attack to a North Korean-backed hacking group.
“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” said Kim. “But the US assertion is an absurd rhetoric and nothing new.”
She described the allegations as a political provocation intended to damage North Korea’s international standing. The FBI also blamed North Korea for the $1.5 billion Bybit hack in February 2025, an accusation Kim also rejected in the statement.
“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” said Kim.
“If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident,” she said.
The statement provided no evidence connecting Washington to the attack.
She maintained that North Korea opposes malicious activity in cyberspace and accused the US of politicizing cybersecurity to interfere in other countries’ affairs.
Last week, blockchain intelligence firm TRM Labs and other onchain investigators attributed the Binance attack to North Korea’s TraderTraitor group, citing both blockchain activity and intelligence gathered outside the blockchain.
TRM identified similarities to earlier North Korea-linked thefts, including small withdrawals from crypto mixer Tornado Cash to fund an attacker’s wallet, preparations well before the theft, and transaction signatures obtained in advance and executed in a single burst. However, it said the laundering activity differed from the pattern following the Bybit hack.
The $352 million Bitget hack has also been linked to a North Korean hacking group, with Bitget CEO Gracy Chen citing preliminary findings linking IP addresses to VPN services used “by a certain DPRK group.”