North Korea Rejects FBI Blame for $6.3B Binance Hack, Calling It a ‘Grave Political Provocation’

North Korea has flatly denied responsibility for the $6.3 billion Binance hack, setting up a standoff between Pyongyang and Washington over what may be the largest crypto theft on record. The denial came from Kim Yo Jong, sister of leader Kim Jong Un, in a statement carried by the state-run Korean Central News Agency on Tuesday.

The FBI said over the weekend that North Korea was behind the theft of more than $6 billion in virtual assets from the world’s largest crypto exchange. It tied the attack to TraderTraitor, the same actors it blames for the $1.5 billion Bybit hack in February 2025. Kim called that attribution “absurd rhetoric and nothing new” and a “grave political provocation” meant to mislead international opinion.

What Pyongyang said, and what it didn’t prove

Kim accused the FBI of trying to brand North Korea a “cyber criminal state” and of blindly linking the country to every major cybercrime. She also rejected the Bybit attribution. She then went further, suggesting that whoever stands to receive the stolen funds if they are recovered might offer “a clue” about who is behind the theft. That was widely read as a hint that the US itself could be involved. Cointelegraph noted that the statement offered no evidence for the insinuation.

She also said North Korea had “issues to reconsider” in light of what she called US hostility. That is notable because Pyongyang has so far stayed silent on President Donald Trump’s overtures to resume summit diplomacy. Trump himself appeared to hedge on Saturday, suggesting investigators were not yet certain North Korea was involved.

The case investigators are building

The FBI’s view is not the only one. Blockchain intelligence firm TRM Labs attributed the Binance hack to TraderTraitor with “high confidence,” citing both onchain and offchain intelligence. Chainalysis and the independent investigator ZachXBT also linked the theft to North Korean hackers.

TRM pointed to familiar hallmarks: careful advance preparation, the use of Tornado Cash to fund attacker wallets, and the coordinated execution of transaction signatures obtained earlier. It also cautioned that the laundering pattern differed from the one seen after the Bybit heist. ZachXBT reported that funds stolen from Binance and from Bitget were commingled at one address after passing through THORChain. Bitget’s CEO, Gracy Chen, said early findings tied IP addresses to VPN services used “by a certain DPRK group.”

The FBI says its probe found the thieves converting stolen assets mainly into ether. It expects them to try moving the money through decentralized finance and “instant swap services.”

Why Pyongyang is pushing back so quickly

Cybersecurity experts consider North Korean hackers among the most prolific crypto thieves in the world, and say the proceeds help fund weapons programs. North Korea denies those allegations. Elliptic estimates the country has stolen $7.6 billion in crypto this year, more than in any previous year.

Analysts in South Korea said the speed of the response probably reflects fear of consequences. Lim Eul-chul, a professor at Kyungnam University, told Reuters that with sanctions already in place, crypto theft has become one of the regime’s key channels for securing funds. A formal attribution could invite tighter efforts to choke off that revenue.

Binance’s recovery

For Binance, the immediate concern is confidence. Customers withdrew more than $4.6 billion shortly after the exchange resumed operations following last Thursday’s attack. Decrypt reported that Binance said hourly deposits had begun to exceed withdrawals, an early sign that the run on the exchange may be easing.

The dispute is unlikely to be settled soon. Private investigators and the FBI point the same way, while Pyongyang denies everything and offers no evidence for its counter-theory. For now, the Binance hack remains a case where the attribution is strong but contested, and where the stolen funds are still moving.

Explore more on this topic with Vexel Search.