North Korea has rejected allegations that it carried out the record $6.3 billion theft from cryptocurrency exchange Binance, with senior official Kim Yo Jong describing the claims as 'absurd rhetoric' and a 'grave political provocation' by the United States.
The denial, issued Tuesday through state media, came days after the FBI attributed the October 29 attack to the North Korean-linked hacking group TraderTraitor. Blockchain analysis firms have reached similar conclusions based on on-chain tracing.
Kim Yo Jong's Statement and North Korean Position
Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un and director of the General Affairs Department, issued the statement via the Korean Central News Agency. She accused Washington of repeatedly linking Pyongyang to cyber incidents worldwide to damage its international image.
'The FBI is trying to brand the DPRK as a cyber criminal state, claiming that it obtained information that a hacking organization supported by the DPRK was involved in the incident,' the statement said, according to reports citing KCNA. 'But the US assertion is absurd rhetoric and nothing new. It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.'
She added that the episode confirmed Washington's hostile attitude and that North Korea was closely monitoring further provocations, while noting Pyongyang opposes malicious cyber activity.
FBI Attribution and Analyst Consensus
The FBI announced on October 31 that TraderTraitor, a state-sponsored group also associated with the Lazarus Group, was responsible for the Binance theft. The agency noted the same actors were behind a $1.5 billion hack of the Bybit exchange earlier in 2025. It urged industry partners to block transactions involving linked addresses and observed the group converting stolen assets primarily into Ethereum, with expectations of further laundering via decentralized finance platforms and instant swap services.
Independent blockchain firms reached parallel conclusions. Elliptic reported that the hackers moved funds through roughly 12,000 wallets and more than 40,000 transactions across 11 blockchains. As of early November, about $2.85 billion, or 44 percent of the approximately $6.43 billion stolen, had been frozen or seized, while roughly $3.24 billion remained in addresses linked to the theft, mostly in bitcoin and ether. Only a negligible amount appeared to have been cashed out.
TRM Labs and Chainalysis also attributed the operation to North Korean actors, consistent with patterns seen in prior incidents. The speed of the initial drain, with most funds moved within the first 20 minutes according to some reports, underscored the sophistication involved.
Binance Response and Recovery Efforts
Binance has described the incident as the result of a months-long campaign rather than a single breach. The exchange said it would cover customer losses from its own funds and has begun progressively reopening withdrawals for additional assets across networks including Binance Smart Chain, Ethereum, Solana, XRP, and Sui.
Co-CEO Richard Teng stated that outflows had normalized and that the platform remained in strong financial health. The company has also expanded its investigation into how attackers compromised systems, including through what appeared to be a bogus job interview targeting employees and an internal AI tool.
These steps follow initial suspension of withdrawals after the breach was detected. The incident has renewed focus on exchange security practices amid broader industry efforts to rebuild trust.
Context of North Korean Cyber Operations
The Binance heist fits into a longer pattern of North Korean cyber theft targeting cryptocurrency platforms to generate revenue for its sanctioned economy. Elliptic estimates that North Korea stole cryptocurrency worth $7.6 billion this year alone, exceeding totals from previous years.
Analysts have long linked Pyongyang's elite hacking units to major incidents, including the 2025 Bybit theft. These operations help circumvent international sanctions and fund state priorities such as weapons development. North Korea has consistently denied involvement in such activities.
U.S. agencies including the Secret Service have joined tracing efforts for the Binance funds, building on prior collaborative work to disrupt North Korean-linked laundering networks. Similar to the approach covered in related reporting on the heist, authorities continue to monitor movement across blockchains and work with exchanges and analytics providers to freeze assets where possible.
Broader Implications for Crypto and Diplomacy
The scale of the theft, far exceeding previous records, has sent ripples through the cryptocurrency sector. It highlights ongoing vulnerabilities even at the largest platforms and raises questions about the resilience of centralized exchanges against state-level actors.
Diplomatically, the episode occurs against a backdrop of limited engagement between the U.S. and North Korea. Pyongyang has remained largely silent on earlier overtures regarding potential summit talks. Kim Yo Jong's remarks framed the accusations as further evidence of hostility, potentially complicating any near-term thaw.
Industry observers note that continued attribution and tracing work could lead to additional sanctions designations or enforcement actions targeting associated wallets and services. At the same time, the partial recovery of funds demonstrates the value of rapid blockchain intelligence in mitigating losses from major incidents.
North Korea's reliance on cybercrime for revenue appears set to persist as long as sanctions remain in place, making attribution disputes and recovery operations recurring features of the crypto landscape. The current case underscores both the challenges and the improving capabilities of law enforcement and private-sector partners in responding to such threats.
