- Kim Yo Jong denied North Korea‘s involvement in the $6.3 billion Binance hack and rejected the FBI’s attribution of the attack to a DPRK-backed Hacking group.
- She suggested without evidence that the US could be behind the theft, pointing to who would receive the stolen funds if recovered.
- TRM Labs, Chainalysis and onchain investigator ZachXBT linked the Binance theft to North Korean Hackers, citing similarities with earlier attacks.
- Kim also dismissed FBI accusations tying North Korea to the $1.5 billion Bybit hack in February 2025.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, on Tuesday rejected the FBI’s claim that a North Korean-backed hacking group carried out the $6.3 billion Binance hack, in a press statement released via the Korean Central News Agency.
Kim, a department director of the Workers’ Party of Korea, called the US assertion “an absurd rhetoric and nothing new” and said the FBI was trying to brand the DPRK a “cyber criminal state.”
She described the allegations as a political provocation intended to damage North Korea’s international standing. Kim also rejected the FBI’s attribution of the $1.5 billion Bybit hack in February 2025 to Pyongyang.
“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” she said.
However, Kim also pointed toward Washington, saying that a careful examination of “who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved” may provide a clue about who was behind the incident. The statement offered no evidence connecting the US to the attack.
Meanwhile, investigators have cited links between the Binance attack and earlier North Korean hacks. Last week, TRM Labs attributed the theft to North Korea’s TraderTraitor group with high confidence, citing onchain and offchain intelligence.
Chainalysis and onchain investigator ZachXBT also linked the incident to North Korean hackers, with ZachXBT identifying a connection between the Binance and Bitget hacks through funds commingled at the same address after passing through THORChain.
TRM Labs pointed to advance preparation, the use of Tornado Cash to fund attacker wallets and the coordinated execution of previously obtained transaction signatures, though it noted the laundering activity differed from the pattern following the Bybit hack.
During early investigation into the hack, Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used “by a certain DPRK group.”
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
