North Korea Denies Record Binance Crypto Heist

North Korea has denied allegations that it carried out the record $6.3bn hack of cryptocurrency exchange Binance, describing the claims as “absurd rhetoric” and a US effort to damage the country’s image. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, said the accusations were a political provocation and rejected the portrayal of cybercrime around the world as the work of the Democratic People’s Republic of Korea (DPRK). The FBI, the US Secret Service and cyber analysts have attributed the attack to North Korea. Blockchain analysts and the FBI say it was led by TraderTraitor, a state-backed hacking group also known as the Lazarus Group. The FBI has asked industry partners to help block transactions linked to the group. Pyongyang has been blamed for other major cyberattacks, including the 2025 theft of $1.5bn from crypto exchange Bybit, but has consistently denied involvement. Research groups say North Korea has developed its cyber operations by recruiting talented students and assigning them to units overseen by the country’s intelligence agency. Binance did not answer the BBC’s questions about North Korea’s alleged role. The company has focused its public comments on the breach and its response. It said net withdrawals since transactions resumed on Sunday totaled $4.72bn, a relatively limited share of its approximately $157bn in assets. Binance said withdrawals were stabilising at expected levels, and that initial checks suggested an engineer’s compromised laptop enabled unauthorised withdrawals. Trading in major cryptocurrencies has resumed after affected assets were frozen with issuers’ help. Binance says it will cover the losses and has already covered about 95% of the stolen assets.

North Korea denied responsibility for the estimated $6.3 billion Binance hack, with Kim Yo Jong calling the FBI’s attribution of the attack to North Korea-linked group TraderTraitor a “grave political provocation.” She accused Washington of trying to portray North Korea as a cybercriminal state and of misleading international opinion. The denial came as blockchain analytics firms Elliptic and Chainalysis continued tracing the stolen cryptocurrency and linked the activity to North Korea-associated actors. Elliptic reported that during the first four days after the attack, hackers used approximately 12,000 wallets across 11 blockchains and made more than 40,000 transactions—an average of one new wallet every 25 seconds. Funds were initially dispersed across thousands of Tron addresses and then moved to Ethereum through cross-chain bridges. The hackers also used decentralized exchanges to convert stablecoins into assets such as ether that issuers cannot freeze. Tether and Circle froze some remaining assets after about $786 million in stablecoins had been converted. The laundering later spread to Solana, following the movement of more than $500 million through intermediary wallets on Tron, according to Chainalysis. Elliptic also detected bitcoin mixing involving about 28 bitcoin, worth $2.2 million. Despite the complicated transfers, Elliptic said $2.85 billion—44% of the $6.43 billion it reported stolen—had been frozen or seized. About $3.24 billion remained in addresses associated with the theft, mostly in bitcoin and ether, and only a negligible amount appeared to have been cashed out. Elliptic said the laundering was proceeding more slowly than after the 2025 Bybit hack and expects remaining funds to be converted gradually, potentially through over-the-counter brokers and exchanges over several months. Binance said it was progressively restoring withdrawals for more crypto assets and networks. The exchange also said it had covered about 95% of the affected amount and was working with industry partners to source the less-liquid tokens that made up the remainder.

North Korea has denied US accusations that hackers linked to the country stole more than $6 billion from cryptocurrency exchange Binance. Kim Yo Jong, sister of North Korean leader Kim Jong Un, called the allegation a “grave political provocation” and dismissed it as “absurd rhetoric and nothing new,” according to state media agency KCNA. She also said Pyongyang had “issues to reconsider” in light of what it described as Washington’s hostility. The accusation came from the FBI, which attributed the theft to TraderTraitor, a hacking group linked to the North Korean state. The article describes the incident as the largest crypto-exchange heist on record, surpassing the approximately $1.5 billion Bybit theft in 2025, which was also attributed to North Korean hackers. Blockchain analytics firm TRM Labs reportedly linked the Binance attack to the same group and said most of the money was moved within 20 minutes. Analysts in Seoul told Reuters that the speed of North Korea’s denial could reflect concern that Washington might intensify efforts to disrupt a funding source widely believed to support the country’s arms development. The article notes that North Korea had not yet responded to former US President Donald Trump’s overtures about restarting summit talks. Separately, Binance said it would resume withdrawals for additional assets on several blockchains, including Binance Smart Chain, Ethereum, Solana, XRP and Sui, beginning at 04:00 GMT Tuesday. Selected tokens on Arbitrum, Optimism, Tron and Base were also included. Binance said it had replaced most of the stolen assets using its own funds.

North Korea has rejected US allegations that it was responsible for stealing more than $6 billion in cryptocurrency from Binance, calling the accusations “absurd rhetoric” and a political provocation. The denial was issued by Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un and a ruling party official, and reported by state news agency KCNA. She said Washington was trying to portray North Korea as a “cybercriminal state” and wrongly attribute cybercrimes around the world to Pyongyang. The FBI said North Korea was responsible for the theft from Binance, the world’s largest cryptocurrency exchange, and identified the perpetrators as members of TraderTraitor, a North Korean state-sponsored unit. Investigators observed the group converting stolen assets into Ethereum and expected further laundering. Binance said it had covered most of the stolen assets using company funds. Kim Yo Jong warned that North Korea had “issues to reconsider” because of what it regards as US hostility, but did not specify what actions Pyongyang might take. The statement comes as North Korea has not publicly responded to US President Donald Trump’s overtures to resume summit diplomacy. Experts have suggested Pyongyang may still be weighing its options. The article notes that cybersecurity experts consider North Korean hackers among the world’s most prolific cryptocurrency thieves and say proceeds help fund the country’s weapons programs. North Korea denies links to cryptocurrency theft and other cybercrimes. Despite being one of the world’s poorest countries, it has directed resources obtained through illicit activity and activities prohibited by UN Security Council resolutions toward its ballistic missile and nuclear weapons programs.