North Korea has rejected allegations that it was responsible for the $6.3 billion Binance hack, challenging the FBI’s findings and accusing Washington of using the cryptocurrency theft to damage Pyongyang’s international reputation.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, strongly denied the country’s involvement in the massive cyberattack. She also appeared to suggest that the United States could have played a role in the incident, although she provided no evidence supporting that claim.
The dispute follows one of the largest cryptocurrency thefts ever recorded, with blockchain investigators linking the attack to a North Korean state-sponsored hacking group.
North Korea Rejects FBI Allegations Over Binance Hack
In a statement published Tuesday through the Korean Central News Agency (KCNA), Kim Yo Jong dismissed the FBI’s allegations as politically motivated.
US authorities previously identified TraderTraitor, a hacking organization allegedly supported by North Korea, as the group responsible for the Binance security breach.
Kim rejected the findings, arguing that Washington was attempting to portray North Korea as a country involved in international cybercrime.
She described the accusations as another example of US hostility toward Pyongyang and claimed that American authorities repeatedly blamed North Korea for major cryptocurrency thefts without justification.
The North Korean official also challenged previous US allegations concerning the $1.5 billion Bybit hack in February 2025.
The FBI had attributed that incident to North Korean hackers, linking it to the same group suspected of carrying out the latest Binance attack.
Kim Yo Jong Raises Questions About US Involvement
Beyond denying North Korea’s involvement, Kim Yo Jong attempted to cast suspicion on Washington’s potential motives.
She suggested that investigators should examine who would ultimately receive the stolen cryptocurrency if authorities successfully recovered the assets.
According to Kim, identifying the eventual beneficiaries of recovered funds could offer clues about the individuals or organizations responsible for the attack.
Her remarks appeared to imply possible US involvement in the Binance hack.
However, the statement presented no evidence connecting the American government to the cryptocurrency theft.
The suggestion also conflicts with findings from multiple blockchain intelligence companies that have identified similarities between the Binance attack and earlier operations attributed to North Korean hacking groups.
TRM Labs Links $6.3 Billion Binance Theft to TraderTraitor
Blockchain intelligence company TRM Labs has attributed the Binance hack to TraderTraitor, an advanced cybercrime group associated with North Korea.
The firm expressed high confidence in its assessment, citing both onchain transaction analysis and intelligence gathered from sources outside blockchain networks.
According to investigators, the attack displayed several characteristics associated with previous North Korean cryptocurrency thefts.
These included extensive preparation, the use of Tornado Cash to fund attacker-controlled wallets, and the coordinated execution of transaction signatures obtained before the theft.
TRM Labs also identified differences between the movement of stolen Binance assets and the laundering methods observed following the Bybit hack.
Nevertheless, the company maintained that the available evidence strongly supported its attribution to TraderTraitor.
Chainalysis and ZachXBT Identify Additional Connections
Other prominent cryptocurrency investigators have reached similar conclusions about the attack.
Blockchain analytics company Chainalysis also linked the Binance theft to North Korean hackers, while independent onchain investigator ZachXBT identified connections involving assets stolen from Binance and Bitget.
According to ZachXBT, cryptocurrency associated with both incidents eventually reached the same blockchain address after moving through THORChain, a decentralized cross-chain liquidity protocol.
The discovery suggested that the attacks could share common perpetrators or laundering infrastructure.
During the initial investigation, Bitget CEO Gracy Chen also reported that preliminary evidence connected certain IP addresses to VPN services previously associated with a North Korean hacking group.
Although these findings strengthen suspicions surrounding North Korean involvement, they do not independently establish the identity of every individual responsible.
Binance Hack Intensifies US-North Korea Tensions
The dispute over the Binance hack adds another source of friction to relations between Washington and Pyongyang.
US authorities have repeatedly accused North Korean-backed hacking organizations of targeting cryptocurrency exchanges, financial institutions, and digital asset platforms.
American investigators have also warned that stolen cryptocurrency can provide significant financial resources to groups operating outside traditional banking systems.
North Korea has consistently rejected allegations that it sponsors cryptocurrency theft or other international cybercrime operations.
Meanwhile, blockchain security firms continue tracking stolen digital assets and examining connections between major cryptocurrency attacks.
The latest developments highlight the growing importance of blockchain intelligence, cybersecurity cooperation, and transaction monitoring in protecting the cryptocurrency industry.
For now, the FBI maintains its attribution of the Binance hack to North Korean-linked actors, while Pyongyang continues to deny responsibility.
