Pyongyang has a rebuttal, and it does not mince words. In the official North Korea Binance hack denial, Kim Yo Jong told state news agency KCNA that the FBI’s attribution of the record $6.3 billion exchange heist to North Korean hackers is “absurd rhetoric and nothing new” – dismissing the US announcement as “a trite provocation” issued one day earlier.
“It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cybercrimes in different parts of the world are our deeds,” the statement continued, adding that Washington is “blindly linking” North Korea with cybercrime whenever incidents occur internationally.
Inside the North Korea Binance hack denial
The US position came first: the FBI and Secret Service, working with cyber analysts, attributed the October 29 attack to TraderTraitor, the state-backed unit also blamed for the $1.5 billion Bybit robbery in February 2025. The FBI issued a public alert naming wallet addresses it says are linked to North Korean hackers and urged exchanges and DeFi services to block transfers.
Kim’s reply carried a curious second clause – analysts read it as an opening rather than a threat. Pyongyang has “issues to reconsider in diverse aspects as regards the very unpleasant US hostile attitude,” she said, while restating the government’s “consistent policy stand” of opposing malicious acts in cyberspace. A follow-up statement the next day kept the door ajar: the US approach is a “hostile policy,” and “there is no need to sit across from hostile individuals” – diplomacy, North Korean style: lights on, door half-shut.
Does the evidence support the attribution?
Blockchain analytics firm Elliptic says its on-chain analysis supports the FBI’s TraderTraitor attribution, reporting roughly $2.85 billion of the stolen funds already frozen or seized – about 44% – and tracing movement through thousands of wallets with signs of automated laundering, though no proof of AI-directed transactions. The FBI has not released full forensic findings, and on-chain analysts note wallet trails cannot by themselves prove nationality. President Trump, asked about the claim, said simply: “We don’t know if it’s North Korea.”
A familiar playbook with new stakes
North Korea has denied every major cyber accusation before – the 2014 Sony hack, WannaCry, the Axie Infinity theft – but the stakes are higher now. Binance says it has covered roughly 95% of stolen customer assets, and South Korea’s foreign ministry warned last week that DPRK cyber activity is a growing threat to the global digital economy. Seoul-based analysts told Reuters the speed of the denial signals concern that Washington will tighten the money trail.
The largest hack in crypto history now has its geopolitical chapter open. Denials, wallet traces and half-quoted statements will keep colliding – and the $2.85 billion still in motion is the part that doesn’t care about rhetoric.
