North Korea Denies Role in Record $6.3bn Binance Hack

North Korea has formally denied involvement in the record $6.3bn (£4.7bn) hack of cryptocurrency exchange Binance, calling the accusations an "absurd rhetoric".

Kim Yo-jong, a top Democratic People's Republic of Korea official and sister of leader Kim Jong Un, pushed back on Tuesday against attributions from US law enforcement and cyber analysts. The denial puts Pyongyang directly at odds with the FBI, the Secret Service and blockchain investigators who say North Korea orchestrated what has been described as the largest hack in history.

Kim Yo-jong, who serves as director of North Korea's General Affairs Department, framed the allegations as political warfare. "The US has made a trite provocation of linking it with the Democratic People's Republic of Korea again," she said in a statement. She called the claims another "sinister attempt" by the US to damage the country's public image.

"It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds," she said.

Kim Yo-jong added that "it is the consistent policy stand of the DPRK government to resolutely oppose all sorts of malicious acts in cyberspace."

Who does the US blame?

Blockchain analysts and the FBI have pointed to the state-backed hacking group TraderTraitor as the unit behind the attack. The FBI has called on industry partners to help block transactions involving cryptocurrency accounts linked to the group.

The group is better known by another name: Lazarus. The same unit was blamed for the then-record $1.5bn hack of crypto exchange Bybit in 2025 — a figure the Binance breach now dwarfs more than four times over.

Pyongyang has faced blame for a string of major cyber attacks over the years, and it has consistently denied every one of them. Analysts say the pattern is structural. Research groups, including the S Rajaratnam School of International Studies think tank, say North Korea has systematically built its cyber operations by recruiting promising students from universities and placing them in hacker units overseen by the country's intelligence agency. North Korea has been accused of relying on cyber-crime to help finance its economy.

What does this change for Binance users?

For customers, the practical question is simple: how much of the money is coming back? Binance has repeatedly said it will cover all losses linked to the attack, and it has so far covered around 95% of the assets stolen in the breach.

The mechanics of the hack, per Binance, were mundane. The company said initial checks indicated that an engineer's laptop had been compromised, enabling an attacker to make unauthorised withdrawals. Since then, Binance has worked with token issuers to freeze impacted assets, and trading in major cryptocurrencies on the exchange has resumed.

The reopen was costly in liquidity terms. Binance said on Sunday that customers pulled out more than $3.6bn of assets as the exchange reopened, after it had suspended all transactions in the wake of the breach. That outflow — more than half the hack's headline value — signals how quickly users vote with their wallets after a security failure.

Since the hack, Binance has largely focused its public statements on the technical nature of the breach and its response to protect users. The BBC has contacted the company for comment.

The standoff now sits in an uncomfortable limbo: a nation-state denial on one side, an FBI attribution and a 95% reimbursement tally on the other. For crypto operators, the message from the FBI's call to block TraderTraitor-linked transactions is that the fight has shifted to the chain itself — and that exchanges, not governments, are the first line of defense.