North Korea has strongly rejected accusations linking the isolated state to a record-breaking $6.3 billion cryptocurrency theft from exchange Binance, dismissing the claims as absurd rhetoric and a politically motivated provocation.
The denial was issued on Tuesday by Kim Yo-jong, a top regime official and sister of North Korean leader Kim Jong Un, who serves as the director of the country’s General Affairs Department. She characterized the allegations as part of an ongoing, sinister effort by the United States to blacken Pyongyang’s public reputation on the global stage.
The sharp rebuttal follows statements from the U.S. Federal Bureau of Investigation, the U.S. Secret Service, and various independent cyber analysts pointing to North Korean state actors as the masterminds behind the digital heist, which authorities describe as the largest cryptocurrency breach in history. Pyongyang has repeatedly faced and rejected similar blame for a wide array of major international cyber attacks over recent years.
According to blockchain investigators and the FBI, the massive infiltration was spearheaded by a state-backed cyber unit known as TraderTraitor, which is also widely recognized by security researchers as the Lazarus Group. That same collective previously drew international blame for orchestrating a then-record $1.5 billion digital asset hack targeting the Bybit cryptocurrency exchange in 2025.
In the wake of the latest breach, the FBI has issued urgent warnings to industry partners and digital asset platforms, urging them to actively monitor and block transactions involving cryptocurrency accounts and wallets connected to the identified hacker network.
Kim Yo-jong condemned the official findings in her public statement, arguing that Washington was orchestrating a predictable smear campaign. She described the accusations as a grave political provocation designed to mislead international public opinion by framing North Korea as the source of widespread cybercrime across the globe.
Binance has maintained its public focus primarily on technical remediation efforts and security measures aimed at safeguarding user assets following the breach, while international security agencies continue their investigation into the movement of the stolen funds.
