North Korea denies role in $6.3B Binance hack, calls FBI blame political provocation

What happened

North Korea has rejected accusations that it carried out the $6.3 billion theft from Binance, with Kim Yo-jong, the sister of leader Kim Jong-un, dismissing the FBI's attribution as a "grave political provocation." Yonhap News Agency, citing a statement carried by the state-run Korean Central News Agency, reported her remarks on Tuesday. Reuters, also citing KCNA, reported that she described the US claims as "absurd rhetoric."

The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored hacking operation associated with the Lazarus Group, was responsible for the theft, which it placed on or about Oct. 29. In an Oct. 31 alert, the bureau asked cryptocurrency businesses to block transactions involving wallets it linked to the actors.

Kim argued that Washington was trying to portray North Korea as a cybercriminal state and to hold it responsible for breaches around the world, calling the allegations an attack on the country's reputation and an infringement of its sovereignty in cyberspace. She also raised the possibility of other motives, pointing to the current US administration's stated intention to confiscate illegally obtained crypto assets for use as a strategic reserve, and suggested that whoever ultimately benefits from recovered funds would offer a clue to the perpetrators. She presented no evidence for that implication. Yonhap noted that her direct intervention in a dispute over a hacking incident was unusual.

Why it matters

The Binance breach is the largest cryptocurrency theft on record, and the exchange between Washington and Pyongyang turns a technical question of attribution into a diplomatic one. The FBI's conclusion rests on intelligence and blockchain analysis rather than a court proceeding, and North Korea has consistently denied involvement in thefts traced to its state-linked hackers. For exchanges, stablecoin issuers and infrastructure providers, the dispute does not alter the operational demand: the bureau's blocking request covers the identified wallets and funds moved onward from them, and recovery depends on cooperation from private firms rather than on any settlement of the blame question.

What the data shows

TRM Labs estimated that roughly $6 billion left Binance wallets across ten blockchains, with most of the money moving in about 20 minutes from 20:05 UTC on Oct. 29; its figures reflected observations through 00:30 UTC the following day. Elliptic traced the assets through about 12,000 wallets spanning 11 blockchains in under four days, logging more than 40,000 transactions, and estimated that only a negligible portion had been converted into cash. Binance said almost $3 billion was frozen by stablecoin issuers and other exchanges, and Tether said it froze more than $1.5 billion in USDT within 30 minutes of suspicious flows being reported. Investigators have valued the theft at approximately $6.3 billion.

Background

North Korea has repeatedly denied responsibility for crypto thefts attributed to its state-backed groups, though public statements from such a senior figure are rare. Several blockchain intelligence companies independently connected the Binance theft to North Korean actors before the denial. TRM Labs attributed the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence, and assessed that valid signed transfers across different blockchains pointed to a compromise of Binance's hot-wallet signing infrastructure. Independent investigator ZachXBT named the Lazarus Group as the likely perpetrator, and Chainalysis strengthened that assessment after linking the stolen funds to assets from a September attack on Bitget that had already been blamed on North Korean hackers.

What to watch

The FBI said stolen assets were being converted mainly into ether and expected further laundering through decentralized finance and instant-swap services, with its request extending to THORNode operators, RPC node operators and instant exchanges as well as trading venues. Binance, which said it found no evidence that wallet private keys had leaked and pledged to cover losses, warned that impersonators could exploit its withdrawal restart with fake compensation offers or fees for faster processing. Kim said Pyongyang was closely watching Washington's actions and could reconsider aspects of its response.

Questions readers ask