North Korea has denied any involvement in last week’s $6.3 billion hack of cryptocurrency exchange Binance. Kim Yo Jong, the sister of supreme leader Kim Jong Un, issued the official statement on Tuesday via the state-run Korean Central News Agency (KCNA). Kim dismissed findings by the United States Federal Bureau of Investigation (FBI), which accused her country of orchestrating the breach.
Kim labeled the US investigators’ allegations as absurd rhetoric and a political provocation. According to her, Washington’s accusations were deliberately engineered to brand North Korea as a cybercriminal state. This stance follows Pyongyang’s earlier rejection of FBI claims linking it to the $1.5 billion hack of crypto exchange Bybit in February 2025.
Without providing supporting evidence, Kim turned the accusations back on Washington. She asserted that parties receiving large amounts of seized crypto during asset recovery should instead be suspected as the true masterminds behind the breach.
TraderTraitor Footprints Behind FBI Allegations
Pyongyang’s statement comes in response to the FBI attributing the Binance hack to the TraderTraitor group. The North Korean state-sponsored hacking collective is known to be directly affiliated with the Lazarus Group.
Blockchain intelligence firm TRM Labs previously assessed TraderTraitor’s involvement with high confidence. That evaluation was based on attack patterns consistent with prior hacking campaigns, including funding the attacker’s wallet via Tornado Cash and executing transaction signatures pre-obtained by the perpetrators before the breach took place.
Stolen Fund Flows on THORChain
The intelligence analysts’ findings align with on-chain tracking data. Independent researcher ZachXBT and blockchain analytics firm Chainalysis identified that looted funds from Binance and exchange Bitget were temporarily mixed in the same wallet address. The pooling of assets from both platforms was detected after the funds were routed through the cross-chain protocol THORChain.
The flow of funds through cross-chain protocols highlights the attackers’ efforts to move assets across different networks. However, the convergence of stolen balances from Binance and Bitget at the same address provided researchers with additional technical evidence to map the movement of the illicit proceeds.
Kim Yo Jong’s political denials now clash directly with transaction data openly recorded on public ledgers. On the diplomatic stage, Pyongyang has chosen to refute the allegations and deflect suspicion toward the recipients of seized assets. On the blockchain, however, independent investigators and law enforcement hold technical records that consistently point to the same hacking syndicate.
Reported by Cointelegraph.
Previously: FBI Declares North Korea Responsible for $6.3B Binance Hack - Funds Flow to DeFi Channels
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
