North Korea Denies Binance Hack Involvement, Suggests US Could Be Behind It

Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, has vehemently denied her country’s alleged involvement in the colossal $6.3 billion hack of cryptocurrency exchange Binance. In a strongly worded statement released via the Korean Central News Agency (KCNA) on Tuesday, Kim not only rejected the Federal Bureau of Investigation’s (FBI) attribution of the attack to a North Korean-backed hacking group but also subtly, and without providing any evidence, pointed a finger at the United States, suggesting that Washington could potentially be behind the massive digital theft.

The FBI had previously asserted that a North Korean-aligned hacking organization was responsible for the record-breaking Binance hack. Kim Yo Jong, who holds a significant position within the Workers’ Party of Korea, dismissed these accusations as "absurd rhetoric and nothing new." She characterized the allegations as a deliberate political provocation orchestrated by the U.S. with the intent of tarnishing North Korea’s international reputation and portraying it as a "cyber criminal state." This is not the first instance of such accusations; the FBI had also blamed North Korea for a separate $1.5 billion hack of the Bybit exchange in February 2025, an accusation that Kim also refuted on the same day.

"This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale," Kim stated, highlighting a perceived pattern of U.S. accusations against North Korea in relation to international cyber incidents.

In a striking turn, Kim Yo Jong did not stop at mere denial. She actively sought to cast suspicion on the United States, proposing a hypothetical scenario where an examination of who ultimately benefits from the retrieved cryptocurrency could reveal the true perpetrators. "If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident," she suggested. However, this assertion was made without any supporting evidence or factual basis connecting Washington to the Binance hack.

Kim reiterated North Korea’s official stance, asserting that the nation opposes malicious activities in cyberspace. She further accused the U.S. of politicizing cybersecurity matters to interfere in the internal affairs of other sovereign nations.

The denials and counter-accusations come in the wake of extensive investigations by blockchain intelligence firms and cybersecurity experts who have linked the Binance hack to North Korea with a high degree of confidence. Last week, TRM Labs, a prominent blockchain intelligence firm, attributed the attack to North Korea’s notorious "TraderTraitor" hacking group, citing a confluence of on-chain and off-chain intelligence. Other reputable investigative bodies, including Chainalysis and the on-chain investigator known as ZachXBT, have also independently corroborated these findings, pointing towards North Korean state-sponsored actors.

These investigators have identified several hallmarks of North Korean cybercriminal activity in the Binance hack. These include sophisticated advance preparation, the use of privacy-enhancing cryptocurrency mixers like Tornado Cash to obscure the flow of funds into attacker wallets, and the employment of previously obtained transaction signatures for coordinated execution of the attack. TRM Labs noted that while many aspects of the attack aligned with previous North Korean operations, the specific methods used for laundering the stolen funds exhibited some differences compared to the patterns observed after the Bybit hack.

Further strengthening the links, on-chain investigator ZachXBT uncovered a direct connection between the Binance hack and the earlier Bitget hack, revealing that stolen funds from both incidents were commingled in the same wallet address after traversing the THORChain decentralized exchange. Early in the investigation into the Binance hack, Gracy Chen, the CEO of Bitget, had also indicated that preliminary findings suggested the use of VPN services linked to IP addresses associated with "a certain DPRK group."

The FBI’s attribution of the Binance hack to North Korea followed a series of significant cyber heists linked to the isolated nation, which has been accused of using cryptocurrency theft to fund its weapons programs and evade international sanctions. The sheer scale of the Binance hack, exceeding $6 billion, marked it as one of the largest cryptocurrency thefts in history, amplifying the urgency for investigators to identify and apprehend those responsible.

Despite the mounting evidence and the consensus among cybersecurity experts, North Korea, through figures like Kim Yo Jong, has consistently maintained its innocence in such incidents. Pyongyang has often characterized such accusations as politically motivated smear campaigns by its adversaries, particularly the United States and its allies. The regime has also accused these nations of hypocrisy, arguing that they themselves engage in cyber espionage and illicit activities.

The statement from Kim Yo Jong represents a predictable but significant diplomatic maneuver by North Korea, aiming to deflect blame, sow discord among investigators, and reinforce its narrative of being a victim of international pressure and false accusations. The lack of evidence presented for her counter-accusation against the U.S. underscores the strategic use of unsubstantiated claims in North Korea’s public relations playbook.

As investigations continue and the global community grapples with the implications of such massive cyber-enabled financial crimes, the exchange of accusations between North Korea and the U.S. highlights the complex and often opaque nature of cybersecurity in the geopolitical arena. The attribution of the Binance hack to North Korea by multiple credible sources presents a significant challenge for the cryptocurrency industry and international law enforcement agencies seeking to hold perpetrators accountable and prevent future large-scale thefts.