North Korea Denies Record Binance Crypto Heist

North Korea has denied US allegations that it was responsible for a record $6.3bn hack of cryptocurrency exchange Binance, describing the claims as “absurd rhetoric” and a political effort to damage the country’s image. Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a senior official, said the US was misleading international opinion by attributing cyber-crimes around the world to the Democratic People’s Republic of Korea (DPRK). She also said the government opposed malicious acts in cyberspace. The FBI, the US Secret Service and cyber analysts have attributed the Binance attack to North Korea. The FBI and blockchain analysts say the operation was led by TraderTraitor, a state-backed hacking group also known as the Lazarus Group, and have asked industry partners to help block transactions linked to the group. Pyongyang has denied previous accusations, though it has been blamed for other major cyber-attacks, including a $1.5bn hack of crypto exchange Bybit in 2025. Research groups say North Korea has developed cyber operations by recruiting promising university students into units overseen by its intelligence agency. Binance has said initial checks indicated that an engineer’s laptop was compromised, allowing an attacker to make unauthorised withdrawals. Trading in major cryptocurrencies resumed after the exchange worked with issuers to freeze affected assets. Binance also said customers withdrew more than $3.6bn in assets as trading reopened after the suspension of transactions. The company has pledged to cover the losses and says it has already covered around 95% of the stolen assets. The BBC contacted Binance for comment; the company’s public statements have largely focused on the technical breach and its response to protect users.

North Korea has denied U.S. allegations that it was involved in the estimated $6.3 billion Binance hack. Kim Yo Jong, sister of leader Kim Jong Un, called the FBI’s attribution of the attack to the North Korea-linked group TraderTraitor a “grave political provocation” and accused Washington of misleading international opinion by blaming North Korea for cybercrimes worldwide. The denial comes as Binance begins gradually restoring withdrawals for additional crypto assets and networks after the attack. Blockchain analytics firms Elliptic and Chainalysis say actors linked to North Korea have used elaborate methods to move and obscure the stolen cryptocurrency. Elliptic reported that during the first four days, hackers used about 12,000 wallets, made more than 40,000 transactions, and operated across 11 blockchains—at a pace averaging one new wallet every 25 seconds. Funds were initially distributed across thousands of Tron addresses and then moved to Ethereum through cross-chain bridges. Hackers also swapped stablecoins for assets such as ether that issuers cannot freeze. Tether and Circle froze some assets, while Elliptic estimates about $786 million in stablecoins had already been converted. The laundering has expanded to Solana, and Elliptic has detected early bitcoin-mixing activity. Despite the movement of funds, approximately $2.85 billion—44% of the $6.43 billion Elliptic says was stolen—has been frozen or seized. About $3.24 billion remains in addresses linked to the theft, mostly as bitcoin and ether. Elliptic says little appears to have been cashed out so far; much of the activity has involved transfers or conversions between cryptocurrencies. It expects the remaining funds may be converted gradually and potentially sold through brokers or exchanges over several months. Binance says it has covered about 95% of the affected amount and is working with industry partners to source the remaining, less liquid tokens.

North Korea has denied US accusations that its hackers were responsible for stealing more than $6 billion from cryptocurrency exchange Binance. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, called the accusation “a grave political provocation” and described it as “absurd rhetoric and nothing new,” according to North Korean state media agency KCNA. She also said Pyongyang had “issues to reconsider” because of what she characterized as Washington’s hostility. The accusation came from the FBI, which blamed TraderTraitor, a hacking group linked to the North Korean state. The article describes the incident as the largest crypto-exchange heist on record, exceeding the approximately $1.5 billion Bybit raid in 2025, which was also attributed to North Korean hackers. Blockchain analysis firm TRM Labs linked the Binance attack to TraderTraitor and said most of the stolen funds were moved within 20 minutes, according to Germany’s DPA news agency. Reuters reported that analysts in Seoul viewed the speed of North Korea’s denial as a possible sign of concern that Washington might intensify efforts to disrupt a funding source widely believed to support the country’s arms development. The article also notes that North Korea had not responded to President Trump’s overtures about renewing summit talks. Separately, Binance said withdrawals for additional assets across several blockchains would resume from 04:00 GMT on Tuesday. The rollout includes assets on Binance Smart Chain, Ethereum, Solana, XRP and Sui, as well as selected tokens on Arbitrum, Optimism, Tron and Base. Binance said it had replaced most of the stolen assets using its own funds.

North Korea has rejected US allegations that it was responsible for stealing more than $6 billion in cryptocurrency from Binance, calling the accusations “absurd rhetoric” and a political provocation. The denial was issued by Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un and a ruling party official, and reported by state news agency KCNA. She said Washington was trying to portray North Korea as a “cybercriminal state” and wrongly attribute cybercrimes around the world to Pyongyang. The FBI said North Korea was responsible for the theft from Binance, the world’s largest cryptocurrency exchange, and identified the perpetrators as members of TraderTraitor, a North Korean state-sponsored unit. Investigators observed the group converting stolen assets into Ethereum and expected further laundering. Binance said it had covered most of the stolen assets using company funds. Kim Yo Jong warned that North Korea had “issues to reconsider” because of what it regards as US hostility, but did not specify what actions Pyongyang might take. The statement comes as North Korea has not publicly responded to US President Donald Trump’s overtures to resume summit diplomacy. Experts have suggested Pyongyang may still be weighing its options. The article notes that cybersecurity experts consider North Korean hackers among the world’s most prolific cryptocurrency thieves and say proceeds help fund the country’s weapons programs. North Korea denies links to cryptocurrency theft and other cybercrimes. Despite being one of the world’s poorest countries, it has directed resources obtained through illicit activity and activities prohibited by UN Security Council resolutions toward its ballistic missile and nuclear weapons programs.