North Korea rejects FBI accusations over record $6.3 billion Binance hack

Pyongyang rejects the accusations

North Korea has officially responded to US accusations of orchestrating a record-breaking hack of the cryptocurrency exchange Binance, in which approximately $6.3 billion (£4.7 billion) was stolen. The statement was made by Kim Yo Jong — the sister of North Korean leader Kim Jong Un and director of the General Department of the Workers' Party — who called the accusations 'absurd rhetoric' and 'a grave political provocation' against the DPRK. According to her, the US is misleading international opinion, 'as if all cybercrimes in the world are our doing,' and doing so without convincing evidence. This was reported by BBC News, Anadolu and Deutsche Welle citing the state agency KCNA.

Who accuses whom of what

The accusation came from the FBI, which over the weekend attributed responsibility to the state-linked hacker group TraderTraitor, also known as the Lazarus Group. The US Secret Service and blockchain analysts backed this version, calling the attack the largest in history. The same group was previously accused of the $1.5 billion hack of the Bybit exchange in 2025, which was the record at the time. The FBI urged industry partners to block transactions involving accounts linked to the group. According to TRM Labs data cited by Deutsche Welle via DPA, most of the funds were withdrawn within 20 minutes.

Binance reveals the attack scheme

Binance published preliminary findings of its investigation: the hackers carried out a multi-stage social engineering campaign. An engineer working on wallets was invited through a legitimate job-search platform to fake interviews with fictitious company representatives; social media accounts with personal photos were used to build trust. At the second 'interview,' he was asked to download an 'assignment' — obfuscated malicious code that security tools failed to detect. Through the compromised laptop and an internal AI tool, the hackers gained control of the computers of two other engineers; one of them had months earlier downloaded a counterfeit application containing password-stealing malware, found via a search engine, and his stolen credentials opened access to systems controlling billions of dollars. Binance apologized, stating that 'this should never have happened,' and for the first time directly confirmed: 'the latest FBI information indicates that North Korea is responsible for this incident.'

Consequences for the exchange and users

After the attack, Binance globally suspended withdrawals; the service was restored on Sunday, after which customers withdrew assets worth billions of dollars. The company said it had reserved more than 100% of the funds needed to cover the losses and, by Saturday, had replenished 98% of the affected tokens; it also announced the resumption of withdrawals of additional assets across several blockchains — Binance Smart Chain, Ethereum, Solana, XRP, Sui, and selected tokens on Arbitrum, Optimism, Tron, and Base — from 04:00 GMT on Tuesday. Binance also promised to increase investment in AI-powered threat detection tools, bring in third-party cyber experts for a full analysis of the incident, and establish a security research fund.

Context and open questions

TechCrunch notesthat the tactics of North Korean hackers — posing as recruiters, venture investors, and IT workers — have long been known to the industry and have been the subject of repeated warnings from US authorities and cybersecurity companies: according to CrowdStrike, about half of intrusions into American tech companies over the past year have been linked to North Koreans. According to Binance's own data, it has faced at least 57 suspected attacks from the DPRK. At the same time, company representative Ross O'Leary declined to answer the publication's questions about how the exchange prevents unauthorized code from being run on employees' laptops and whether third-party security audits were carried out before the hack. Washington links cryptocurrency thefts to funding the DPRK's weapons programs; Kim Yo-jong stated that Pyongyang is 'closely monitoring' the provocations and that Washington's hostility may force it to reconsider its position on a number of issues. Deutsche Welle adds that the DPRK has so far remained silent on signals from the Trump administration about resuming summit talks, and analysts in Seoul link the speed of the denial to fears that the US will step up efforts to shut off the funding source.

Image source, Pool via Bloomberg