North Korea denies being behind record $6.3bn Binance hack

A senior North Korean official has forcefully rejected widespread international accusations that Pyongyang orchestrated the historic $6.3 billion breach of leading cryptocurrency platform Binance, framing the allegations as a deliberate, bad-faith campaign by the United States to tarnish the isolated nation’s global reputation. Kim Yo-jong, director of the DPRK’s General Affairs Department and sibling to supreme leader Kim Jong Un, delivered the formal public rebuke in a Tuesday statement, dismissing the hacking claims as baseless, “absurd rhetoric” that represents the latest in a long line of Washington’s hostile, underhanded attempts to mislead global public opinion. The U.S. Federal Bureau of Investigation, U.S. Secret Service, and independent global cybersecurity and blockchain analysts have publicly attributed the unprecedented heist to TraderTraitor — a state-linked North Korean hacking collective also widely known as the Lazarus Group — marking the largest recorded crypto breach in history. U.S. federal law enforcement agencies have already issued a public call for partners across the crypto industry to cooperate in identifying and freezing any digital transactions linked to accounts associated with the suspected hacking unit. Kim pushed back fiercely against the pattern of accusations, arguing that Washington’s repeated habit of pinning nearly all major global cyber incidents on the DPRK constitutes a “grave political provocation” against the country, and emphasized that the DPRK’s official national policy is to firmly oppose all malicious, illegal activity in digital cyberspace. This high-profile incident is far from the first time North Korea has been tied to major large-scale cyber heists: the same TraderTraitor collective was formally blamed for the 2025 record-breaking $1.5 billion breach of crypto exchange Bybit, and multiple independent think tanks including Singapore’s S Rajaratnam School of International Studies have documented that Pyongyang has spent years systematically building out its state cyber operations, recruiting top technical university students for specialized training under the oversight of the nation’s intelligence agency. North Korea has consistently denied all prior allegations of state-sponsored cybercrime, which multiple Western governments and analysts argue the country relies on as a critical revenue stream to bypass harsh international economic sanctions. For its part, Binance has focused its public communications since the breach on technical updates and user protection measures, confirming that initial forensic investigations found the attack originated when a threat actor compromised a senior engineer’s work laptop to initiate unauthorized mass withdrawals. After a full suspension of all platform operations in the immediate aftermath of the heist, Binance worked directly with major cryptocurrency issuers to freeze a large share of the stolen funds before resuming full trading services. When the platform reopened, data showed customers withdrew more than $3.6 billion in assets in a 24-hour period, though Binance has reiterated its commitment to covering 100% of user losses tied to the attack, noting that it has already reimbursed roughly 95% of the total stolen value to affected clients. The BBC has reached out to Binance’s leadership for additional formal comment on the ongoing incident.