Key facts
- Kim Yo Jong said the FBI was trying to brand the DPRK a cyber criminal state over the Binance incident.
- Kim said the US assertion was an absurd rhetoric and nothing new, calling it a grave political provocation.
- Kim suggested, without evidence, that the US could be behind the theft, urging it to examine who benefits if the funds are retrieved.
- TRM Labs attributed the Binance attack to North Korea's TraderTraitor group with high confidence, citing onchain and offchain intelligence.
- ZachXBT linked the Binance and Bitget hacks, saying stolen funds from both were commingled at the same address after passing through THORChain.
- Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used by a certain DPRK group.
North Korea's Kim Yo Jong on Tuesday rejected the FBI's finding that a North Korean-backed hacking group stole $6.3 billion from the crypto exchange Binance, calling the US claim absurd rhetoric and nothing new. The statement was released through the Korean Central News Agency (KCNA), North Korea's state news agency.
"The FBI is trying to brand the DPRK as a 'cyber criminal state', claiming that it obtained information that a hacking organization 'supported' by the DPRK was involved in the incident," Kim said, according to KCNA. "But the US assertion is an absurd rhetoric and nothing new." She described the allegations as a political provocation intended to damage North Korea's international standing.
Kim also appeared to suggest, without offering evidence, that the US could have been behind the theft. "If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident," she said. She maintained that North Korea opposes malicious activity in cyberspace and accused the US of politicizing cybersecurity to interfere in other countries' affairs.
The FBI said at the weekend that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance. Kim also rejected the FBI's attribution of the $1.5 billion Bybit hack in February 2025 to North Korea.
Last week, blockchain intelligence firm TRM Labs attributed the Binance attack to North Korea's TraderTraitor group with high confidence, citing onchain and offchain intelligence. TRM Labs pointed to similarities with previous North Korean attacks, including advance preparation, the use of Tornado Cash to fund attacker wallets and the coordinated execution of previously obtained transaction signatures, though it said the laundering activity differed from the pattern after the Bybit hack.
Other investigators, including Chainalysis and ZachXBT, also linked the theft to North Korean hackers. ZachXBT identified a connection between the Binance and Bitget hacks, saying stolen funds from both incidents were commingled at the same address after passing through THORChain. During the early investigation, Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used by a certain DPRK group.