North Korea Says It Had Nothing to Do With the Binance Hack—And Calls the FBI’s Blame Game ‘Absurd’

ABC News, Bloomberg, the Financial Times, and BBC contributed to this report.

North Korea is not taking the blame for the biggest crypto heist in history. On Tuesday, Kim Yo Jong – the influential sister of leader Kim Jong Un – flatly rejected the FBI’s claim that North Korean hackers were behind the $6.3 billion Binance hack. She called the accusation “a trite provocation” and “absurd rhetoric.” Not exactly a diplomatic olive branch.

The FBI had said the attack was orchestrated by a North Korean hacking group known as TraderTraitor, also called the Lazarus Group. That same unit was blamed for a $1.5 billion hack of the Bybit exchange last year. Binance, the world’s largest crypto exchange, disclosed Friday that hackers had stolen more than $6 billion – the largest such heist on record. The FBI then pointed the finger at Pyongyang.

Kim Yo Jong wasn’t having it.

“This is not the first time that the US has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” she said in a statement.

She added that Washington’s “hostile attitude” was on full display and that North Korea was “closely monitoring” US provocations. The statement used the abbreviation for North Korea’s official name, the Democratic People’s Republic of Korea.

Outside experts, however, see a pattern. North Korea has increasingly turned to cryptocurrency theft and other illicit cyber activities to raise hard currency, according to analysts. That money helps sustain its struggling economy and fund its nuclear program despite heavy international sanctions. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen 1.5 trillion won ($1.1 billion) in crypto and other virtual assets over the previous five years.

North Korea has denied involvement in most major cyberattacks, but it has been linked to plenty. There was the 2013 campaign that paralyzed South Korean financial institutions. The 2014 Sony Pictures hack. The WannaCry malware attack in 2017. Pyongyang has consistently denied responsibility. South Korea’s Foreign Ministry said Monday that North Korea’s illicit cyber activities pose a growing threat to the global digital economy and that Seoul is cooperating closely with the US and the international community.

The timing is awkward. The Binance heist comes as North Korea has ramped up weapons tests, likely to gain leverage in potential diplomacy with the US after President Trump expressed a desire to restore talks with Kim Jong Un. On Tuesday, North Korea said it tested a new cluster warhead for strategic cruise missiles. Asked about the hack during a Halloween party at Mar-a-Lago, Trump suggested investigators weren’t certain.

“I’m not concerned. We’re learning about it,” he said. “We don’t know if it’s North Korea.”

He added that investigators could still determine it was.

Binance, meanwhile, is trying to get back to normal. The exchange resumed trading after working with issuers to freeze assets tied to the hack. A spokesperson said a net $4.72 billion has been withdrawn since transactions resumed Sunday – a “relatively limited portion” of Binance’s roughly $157 billion in total assets. The company has repeatedly said it will cover all losses and has so far covered about 95% of the stolen assets. Initial checks suggested an engineer’s laptop was compromised, allowing an attacker to make unauthorized withdrawals.