North Korea denies role in $6.3 billion Binance hack and points finger at the US
North Korea has denied any role in the $6.3 billion hack of Binance, a large cryptocurrency exchange. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, called the US allegations politically motivated and suggested, without providing evidence, that the United States could have been behind the theft.
Her statement came after the FBI and several blockchain investigation firms linked the attack to a North Korean-backed hacking group.
Key points in the dispute
- Kim Yo Jong denied North Korea's involvement in the $6.3 billion Binance hack in a statement released through the Korean Central News Agency (KCNA) on Tuesday.
- She rejected the FBI's attribution of the attack to a North Korean-backed hacking group and called the US claim "absurd rhetoric and nothing new."
- She also rejected the FBI's accusation that North Korea was behind the $1.5 billion Bybit hack in February 2025.
- Kim suggested, without evidence, that whoever receives the stolen funds when they are recovered could show who is behind the attack.
- Investigation firms TRM Labs, Chainalysis and ZachXBT have all linked the theft to North Korean hackers.
What Kim Yo Jong said
In the statement, Kim said the FBI was trying to brand North Korea, officially called the DPRK, as a "cyber criminal state" by claiming it had information that a hacking group supported by the country was involved. She described the allegations as a political provocation meant to damage North Korea's international standing.
"This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the 'cyber crime' incidents whenever they occur on an international scale," Kim said.
Kim's unproven claim about the US
Kim pointed suspicion at the US without supplying any evidence. "If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident," she said.
The statement contained no evidence connecting Washington to the attack. Cointelegraph reached out to the FBI for comment.
What investigators have found
Last week, blockchain intelligence firm TRM Labs attributed the Binance attack to North Korea's TraderTraitor group with high confidence, citing both onchain and offchain intelligence. Onchain means information taken from the public blockchain records of transactions; offchain means information from other sources.
TRM Labs pointed to similarities with earlier North Korean attacks. These included advance preparation, the use of Tornado Cash, a tool that mixes cryptocurrencies to hide their trail, to fund attacker wallets, and the coordinated use of transaction signatures obtained beforehand. The firm noted, however, that the laundering activity differed from the pattern seen after the Bybit hack.
Other investigators reached similar conclusions. Chainalysis and onchain investigator ZachXBT also linked the theft to North Korean hackers. ZachXBT identified a connection between the Binance and Bitget hacks, saying stolen funds from both incidents were mixed at the same address after passing through THORChain, a service that lets users swap tokens across blockchains.
During the early stage of the investigation, Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used "by a certain DPRK group."
Claims and counterclaims remain unproven
The FBI's attribution and North Korea's denial directly conflict. North Korea has offered no evidence for its suggestion that the US was involved, and the FBI has not commented publicly in the source material. Readers should treat Kim's accusation as an unproven claim. The findings from TRM Labs, Chainalysis and ZachXBT are reported conclusions by investigation firms, not official confirmation.
Why this dispute matters
The Binance hack is one of the largest thefts in crypto history at $6.3 billion. If North Korea's involvement is confirmed, it would follow a pattern the FBI has already alleged with the $1.5 billion Bybit hack in February 2025. The disagreement between North Korea and the US leaves open questions about who is responsible for the stolen funds.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.