North Korea has denied involvement in the $6.3 billion Binance hack, with Kim Yo Jong, sister of leader Kim Jong Un and a senior ruling party official, calling US allegations linking the country to the record crypto theft absurd rhetoric.
In a statement carried by state news agency KCNA and reported by Reuters, Kim accused Washington of attempting to portray North Korea as a cyber criminal state after the FBI attributed the attack to a state-backed hacking group. She described the allegations as a grave political provocation and accused the US of misleading international public opinion by blaming North Korea for cybercrimes committed around the world.
FBI attribution and investigation
The denial follows an October 31 FBI advisory identifying North Korea’s TraderTraitor operation as responsible for the theft of more than $6 billion in crypto assets from Binance. The agency said investigators observed the attackers converting stolen funds primarily into Ethereum, with further laundering expected through decentralized finance platforms and instant swap services.
The October 29 breach compromised Binance hot wallets across ten blockchains, resulting in approximately $6.36 billion in unauthorized withdrawals, according to blockchain intelligence firm TRM Labs. The firm also attributed the attack to North Korea’s TraderTraitor group with high confidence, citing blockchain transaction patterns and other intelligence.
The US Secret Service is investigating alongside the FBI, IRS Criminal Investigation and Justice Department officials, with authorities working to identify and freeze stolen assets.
Binance recovery and reserves
Binance has since replenished approximately 95% of affected assets using company funds and begun restoring withdrawals across multiple networks. The exchange also completed its latest Proof of Reserves verification for ten major crypto assets, allowing users to confirm their balances were backed at least 1:1 as of October 31.
Binance has not publicly identified the perpetrators and continues investigating how attackers compromised its infrastructure.
