North Korea Denies $6.3B Binance Hack Role, Blames U.S.

North Korea has rejected U.S. accusations linking the country to the $6.3 billion Binance hack, with Kim Yo Jong—sister of North Korean leader Kim Jong Un—saying the FBI’s claims are politically motivated. In a statement carried by the Korean Central News Agency (KCNA), she dismissed the U.S. narrative that a North Korea-backed hacking group was involved and suggested, without providing evidence, that the United States could instead have had a role.

The denial comes after U.S. authorities attributed the attack to a DPRK-linked group, and after similar allegations surfaced regarding another major incident: the FBI also blamed North Korea for the $1.5 billion Bybit hack in February 2025, a charge Kim said Tuesday was likewise part of an attempt to smear Pyongyang.

Key takeaways

• Kim Yo Jong denied North Korea’s involvement in the $6.3 billion Binance hack and criticized the FBI’s attribution as “absurd rhetoric.”
• She did not present evidence for U.S. involvement, instead urging scrutiny of who benefits from recovered funds.
• Blockchain investigators cited multiple intelligence signals linking the theft to North Korea’s TraderTraitor group, including methods seen in prior DPRK-linked attacks.
• While U.S. officials point to a North Korea-backed actor, investigators also highlight operational details that appear consistent with earlier incidents.

Kim Yo Jong rejects FBI attribution

According to a statement reported via KCNA, Kim Yo Jong responded directly to the FBI’s claims that the agency had information indicating that a hacking organization “supported” by the DPRK participated in the Binance incident.

Kim said the U.S. portrayal of North Korea as a “cyber criminal state” is an attempt to frame the DPRK in a way that damages its standing. She characterized the allegations as a familiar pattern—one that surfaces internationally when major cybercrimes occur—arguing the U.S. repeatedly “blindly link[s]” North Korea to large-scale cyber incidents.

She also asserted that North Korea opposes malicious activity in cyberspace and accused Washington of politicizing cybersecurity to interfere in other countries’ affairs. The statement did not provide additional substantiating material or alternative technical findings to support her counter-claims.

Suspicion shifts to the U.S.—without evidence

Beyond rejection, Kim Yo Jong pointed suspicion at the United States for the hack, again without offering proof. Her argument focused on incentives: she suggested that if the U.S. were to examine who would receive a large portion of the “stolen cryptocurrency” after it is retrieved, it could identify the party behind the operation.

That line of reasoning is notably different from the method commonly used by investigators in these cases—namely, tracing on-chain activity and correlating operational behavior with earlier known campaigns. Kim’s statement, as reported, did not outline specific indicators—such as wallet clusters, laundering routes, or communications artifacts—that would connect the theft to any particular U.S. actor.

Cointelegraph reported reaching out to the FBI for comment, but the statement itself offered no direct response to the evidentiary basis cited in the U.S. attribution.

Investors and investigators cite links to earlier DPRK activity

While North Korea denied involvement, multiple blockchain intelligence researchers have previously tied the Binance hack to North Korea-linked activity. Last week, TRM Labs attributed the attack to North Korea’s TraderTraitor group with high confidence, citing both on-chain and off-chain intelligence.

TRM Labs said similarities with earlier DPRK-linked incidents were a key part of its assessment. Those similarities included advance preparation, the use of Tornado Cash to help fund attacker wallets, and coordinated execution of transaction signatures obtained beforehand. At the same time, TRM Labs noted that laundering behavior in this case did not fully match the specific pattern that followed the Bybit hack—an observation that suggests the actor may adapt methods across different operations rather than repeating a single fixed blueprint.

Other investigators have also pointed to North Korean involvement. Chainalysis and ZachXBT, for example, linked the theft to North Korean hackers. ZachXBT additionally reported a connection between the Binance and Bitget hacks, stating that stolen funds from both incidents were commingled at the same address after passing through THORChain.

Investigative timelines also show how the narrative around these attacks can develop quickly. In early coverage of the Bitget hack, Bitget CEO Gracy Chen said preliminary findings pointed to IP addresses connected to VPN services used “by a certain DPRK group.” While VPN usage alone is not definitive, it can fit into a broader pattern of operational behavior that researchers use alongside other evidence.

The contrast between the U.S. attribution and Kim’s rejection highlights a recurring tension in high-profile crypto incidents: government statements may rely on classified or intelligence sources, while outside researchers often emphasize transparency through blockchain analytics and publicly observable behaviors. In this case, the public debate centers on whether the evidence supporting attribution will be compelling enough to outweigh political rebuttals.

What to watch as the dispute continues

As investigators continue to analyze the Binance hack and as any recovered funds move, the most important developments to monitor are whether authorities and analysts publish additional technical detail that strengthens attribution—or whether new evidence emerges that challenges the current links to TraderTraitor and other DPRK-associated tactics.