North Korea rejects US claim over $6.3 billion Binance breach
Security & Exploits ·
Pyongyang's Kim Yo Jong dismissed FBI attribution of the hack as a political attack and pointed to Washington's own crypto-reserve plans as a possible motive.
North Korea has pushed back against US investigators who named the country as the source of a $6.3 billion hack on Binance, with Kim Yo Jong, a senior Workers' Party official, describing the accusation as politically motivated. State media carried her remarks on November 3, in which she argued the US has a pattern of tying her country to major crypto thefts without proof, citing a prior $1.5 billion incident at Bybit as an example.
Kim went further than simple denial, suggesting Washington itself had reason to orchestrate such a theft. She referenced the US administration's stated plan to seize illicitly obtained crypto and fold it into a national strategic reserve, implying that whoever stands to gain from recovered funds deserves scrutiny as a possible culprit. She also said Pyongyang was watching the Trump administration's posture toward North Korea and had reason to reassess its stance if hostility continued.
The denial follows a formal attribution by the FBI, which linked the Binance attack to a North Korean state-linked group known as TraderTraitor. Investigators said the actor moved stolen assets into ETH before routing them through DeFi protocols and instant-swap services to obscure their trail. Blockchain analytics firms TRM Labs and Chainalysis separately reached similar conclusions, tying the hack to the same group.
Binance responded to the breach by briefly pausing withdrawals and working with law enforcement to trace the funds; withdrawals have since reopened, with users pulling out more than $4 billion immediately afterward against roughly $1 billion in deposits. Separately, on-chain trackers reported that some of the stolen funds passed through protocols including THORChain and Relay, temporarily driving their daily revenues sharply higher.
The episode has also rippled into market behavior: whale wallets pulled 226 million units of XRP from Binance following the breach, a shift described as reaching levels last seen in 2022, even as price action and ETF inflows pointed to mixed rather than uniformly negative sentiment. What remains unresolved is whether US authorities will respond publicly to Kim's counter-allegation, and whether further on-chain tracing will clarify how much of the stolen $6.3 billion has moved beyond recovery.