Key Takeaways
North Korea has publicly denied responsibility for the $6.3 billion Binance hack, with Kim Yo Jong, the influential sister of leader Kim Jong Un, accusing Washington of using the theft to portray Pyongyang as a cybercriminal state.
In a statement carried by the Korean Central News Agency (KCNA) on Nov. 3, Kim rejected the FBI’s findings and described the allegations as a political provocation.
The response came three days after US investigators attributed the Oct. 29 cryptocurrency theft to North Korea’s TraderTraitor hacking operation.
Kim also raised questions about Washington’s plans for confiscated cryptocurrency, introducing a new political controversy into an investigation already complicated by the rapid movement of stolen assets.
Kim accused US authorities of repeatedly blaming North Korea whenever major international cybercrimes occur. She called the FBI’s attribution “absurd rhetoric and nothing new,” arguing that Washington was attempting to damage Pyongyang’s international reputation.
Her statement went further, suggesting that investigators should examine who ultimately receives any cryptocurrency recovered from the Binance theft.
Kim pointed to the Trump administration’s Strategic Bitcoin Reserve policy as a possible clue, implying that Washington itself could have an interest in the stolen assets. However, she presented no evidence linking the US government to the attack.
The suggestion also overlooks that identifying and recovering stolen cryptocurrency does not automatically transfer ownership to the US government. Recovered assets may be subject to victim restitution and other legal proceedings.
The unusually direct response from Kim comes amid uncertainty over renewed diplomatic engagement between Washington and Pyongyang.
The FBI’s Oct. 31 advisory explicitly identified TraderTraitor as responsible for stealing more than $6 billion from Binance.
Investigators said the attackers were converting stolen assets primarily into Ethereum before potentially laundering them through decentralized finance platforms and instant-swap services.
The agency published cryptocurrency addresses associated with the theft and urged exchanges, THORChain operators, and other blockchain service providers to block related transactions.
Independent blockchain investigations support the attribution to North Korea.
TRM Labs traced approximately $6.36 billion in unauthorized withdrawals across ten blockchains, identifying signs of compromised transaction-signing infrastructure.
Meanwhile, Elliptic reported that the laundering operation had used approximately 12,000 wallets and more than 40,000 transactions within four days.

As of Nov. 2, approximately $3.24 billion remained in theft-linked addresses, primarily in Bitcoin and Ethereum.
The political dispute has also revived accusations against Binance itself.
Crypto investigator Tyler Reed, known as BoringSleuth on X, alleged that a Binance developer was involved in the 2022 FTX hack.
Reed claimed he had previously investigated the alleged connection and subsequently experienced intimidation, surveillance, and an attempted attack against him.
He further accused Binance of participating in other cryptocurrency thefts and money laundering operations. However, Reed did not provide independently verifiable evidence in the cited post to establish Binance’s involvement in the FTX theft or to support his personal allegations.
His claims are separate from Kim Yo Jong’s statement and do not establish an alternative explanation for the October Binance breach.
For now, the FBI’s attribution remains unchanged, while the stolen cryptocurrency continues moving through blockchain networks.
North Korea’s denial introduces a diplomatic confrontation, but neither Pyongyang’s suggestion of US involvement nor separate accusations against Binance has displaced the evidence presented by investigators.
The next development will depend on whether authorities can identify the operators behind the transactions and intercept stolen assets before they reach cash-out services.