North Korea denies role in $6.3B Binance hack and points the finger at the US

Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected allegations that North Korea was behind the $6.3 billion Binance hack and suggested, without evidence, that the US may have been involved. For high-risk payment and crypto operators, the useful part is not the rhetoric; it is that attribution for this kind of theft is still being contested while investigators continue to map the laundering trail.

1. In a statement released via the Korean Central News Agency (KCNA) on Tuesday, Kim pushed back on the FBI’s claim that the Binance attack was carried out by a North Korean-backed hacking group. “The FBI is trying to brand the DPRK as a ‘cyber criminal state’,” she said, adding that the US claim was “an absurd rhetoric and nothing new.”
2. She described the allegation as a political provocation aimed at damaging North Korea’s international standing. Kim also rejected the FBI’s earlier attribution of the $1.5 billion Bybit hack in February 2025 to North Korea. On the Binance case, she said the US should examine “who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved,” but offered no evidence tying Washington to the theft.
3. Last week, blockchain intelligence firm TRM Labs said it attributed the Binance attack to North Korea’s TraderTraitor group with high confidence, citing onchain and offchain intelligence. Chainalysis and ZachXBT also linked the theft to North Korean hackers. TRM Labs pointed to similarities with earlier North Korean operations, including advance preparation, the use of Tornado Cash to fund attacker wallets, and coordinated execution of previously obtained transaction signatures.
4. TRM Labs also said the laundering activity differed from the pattern seen after the Bybit hack. ZachXBT separately said stolen funds from the Binance and Bitget hacks were commingled at the same address after passing through THORChain. During the early investigation into the hack, Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used “by a certain DPRK group.”

The thing that matters for PSPs, exchanges, and banks is that attribution remains a live issue, but the operational markers are the same: cross-incident fund commingling, Tornado Cash usage, THORChain flows, and reused infrastructure are the kinds of signals compliance teams will keep seeing when these cases move from headlines to investigations.