North Korea rejects US accusations of orchestrating $6.3bn Binance hack

North Korean officials have publicly rejected accusations from U.S. authorities that a state‑backed hacking unit was responsible for the $6.3bn (approximately £4.7bn) theft from cryptocurrency exchange Binance. In a statement, Kim Yo‑jong, director of the General Affairs Department and sister of leader Kim Jong Un, described the claims as "absurd rhetoric" and a "sinister attempt" by the United States to tarnish Pyongyang’s image.

The United States Federal Bureau of Investigation, the Secret Service and independent cyber analysts have all attributed the breach to a North Korean‑linked group known as TraderTraitor, also identified as the Lazarus Group. The FBI has urged cryptocurrency platforms to block transactions linked to accounts associated with the group. Binance itself has not commented on the alleged North Korean involvement, focusing instead on technical details of the breach and user protection measures.

Background

The hack, described by officials as the largest in cryptocurrency history, resulted in a net withdrawal of $4.72bn from Binance after the exchange resumed transactions on a Sunday following the incident. Binance’s total assets are estimated at around $157bn, meaning the stolen amount represents a relatively small proportion of its holdings. The incident follows a pattern of high‑profile cyber‑thefts linked to North Korean actors, including a $1.5bn breach of the Bybit exchange in 2025, which was also blamed on the TraderTraitor/Lazarus Group.

North Korea has long been accused of using cyber‑crime to generate revenue for its sanctioned economy. Researchers note that the regime systematically recruits university students into hacker units overseen by its intelligence agency. Despite repeated accusations, Pyongyang has consistently denied involvement in such attacks, asserting a policy of opposing malicious cyber activity.

Why it matters

The alleged theft has significant implications for the global cryptocurrency market, highlighting vulnerabilities in digital asset platforms and prompting calls for tighter security and regulatory oversight. U.S. agencies view the hack as evidence of state‑sponsored cyber‑crime financing North Korea’s economy, while the Korean government frames the accusations as a political provocation. Binance’s users and the broader crypto community are directly affected by the loss of funds and the potential for further illicit transfers, prompting the exchange to cooperate with law‑enforcement efforts to trace and freeze stolen assets.

What happens next

The FBI has continued to request cooperation from cryptocurrency exchanges to block transactions tied to the TraderTraitor group. While Binance has not confirmed any direct engagement with U.S. investigators, its spokesperson indicated ongoing monitoring of the situation. North Korean officials have reiterated their stance that the DPRK opposes malicious cyber acts and have called for the United States to cease what they describe as misleading the international public. No further official statements from U.S. agencies or Binance were reported at the time of writing.