North Korea denies $6.3bn Binance hack, accuses US of provocation

Kim Yo Jong, sister of North Korea’s leader Kim Jong Un.
North Korea has denied allegations that it was responsible for the theft of approximately $6.3bn from cryptocurrency exchange Binance, describing the accusation by the United States as a political provocation, the BBC reported on Tuesday.

Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, accused Washington of attempting to portray her country as the source of cybercrimes committed around the world.

Kim made the remarks in a written statement carried by North Korea’s state-run Korean Central News Agency (KCNA) on Tuesday, according to Reuters.

The denial followed an announcement by the United States Federal Bureau of Investigation (FBI) on Saturday that North Korea was behind the theft of more than $6bn in virtual assets from Binance, the world’s largest cryptocurrency exchange.

The FBI attributed the October 29 attack to a North Korean state-sponsored hacking group known as TraderTraitor and urged cryptocurrency businesses and other industry operators to block transactions involving digital wallets linked to the group.

“The US assertion is absurd rhetoric and nothing new,” Kim said, according to KCNA.

She described the allegation as “a grave political provocation” against North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), accusing the United States of misleading international public opinion by attributing cybercrimes committed in different parts of the world to Pyongyang.

The Binance incident is believed to be the largest cryptocurrency theft on record.

According to the Associated Press, blockchain intelligence firm TRM estimated that approximately $6.36bn was transferred from Binance wallets across 10 blockchains, with most of the transactions completed within about 20 minutes.

Blockchain analysts have also linked the attack to TraderTraitor, while the FBI said its investigation identified the North Korean-linked group as responsible.

Binance initially said its investigation suggested that an engineer’s laptop might have been compromised before the breach. The exchange later identified additional points of compromise.

The cryptocurrency exchange said it had set aside more than $6.34bn in company funds to cover the stolen assets and was working with blockchain partners to recover them. Approximately $3bn worth of affected assets had also been frozen, the Associated Press reported.

The attack forced Binance to temporarily suspend withdrawals while it investigated the breach, although trading and withdrawal services subsequently resumed.

The latest accusation comes amid a series of major cryptocurrency thefts linked to North Korean-backed hacking groups.

In February 2025, the FBI attributed the theft of approximately $1.5bn from cryptocurrency exchange Bybit to TraderTraitor. The incident was then regarded as the largest cryptocurrency heist on record.

North Korea has repeatedly denied involvement in cyberattacks attributed to hackers linked to the country.

However, cybersecurity experts have identified cryptocurrency theft as an increasingly important source of foreign currency for Pyongyang, which faces extensive international sanctions.

The FBI said the stolen Binance assets were being converted primarily into Ether, the cryptocurrency used on the Ethereum network, as the hackers prepared to move the funds through decentralised finance platforms and instant-swap services to obscure their origins.

Binance has said it is working with law enforcement agencies and other partners to trace the stolen funds and recover the assets.