Crypto Heist: North Korea, US Clash Over Alleged $6.3bn Binance Cyber Theft

North Korea has rejected U.S. allegations that its state-sponsored hackers stole more than $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, accusing Washington of using the incident to portray the country as a global cybercrime hub.

The denial, issued by Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, comes amid growing international concerns over the scale of cryptocurrency thefts, the security of digital asset platforms and the increasing use of cyberattacks to finance illicit activities.

According to the Korean Central News Agency (KCNA), Kim described the Federal Bureau of Investigation’s (FBI) attribution of the October 29 attack to a North Korean-linked hacking group as “absurd rhetoric” and “a grave political provocation” against the Democratic People’s Republic of Korea (DPRK).

“The FBI is trying to brand the DPRK as a cyber criminal state, claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the incident,” she said.

“But the US assertion is absurd rhetoric and nothing new. It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cybercrimes in different parts of the world are our deeds,” Kim added.

In a cyber alert issued on October 31, the FBI said North Korea stole more than $6 billion in virtual assets from Binance on or about October 29. The agency identified the cyber operation as TraderTraitor, a North Korean state-sponsored hacking activity previously associated with cryptocurrency thefts.

The bureau said its investigations showed that the attackers had converted the stolen assets primarily into Ether, a cryptocurrency operating on the Ethereum blockchain, and warned that the funds were likely to be moved through decentralised finance platforms and instant cryptocurrency swapping services to obscure their origins.

The latest dispute has further complicated the investigation into the breach, which has been described as potentially the largest cryptocurrency theft on record. Blockchain intelligence firms had earlier linked the attack to North Korea based on the movement of funds and similarities with previous cyber operations attributed to the country.

Binance disclosed that approximately $6.3 billion in digital assets had been affected by the breach, which involved the exchange’s hot-wallet infrastructure. The company temporarily suspended withdrawals while it investigated the incident and worked with law enforcement agencies, blockchain intelligence firms and cryptocurrency issuers to track and freeze the stolen funds.

The exchange subsequently committed company resources to cover the affected assets, assuring customers that their funds would not be lost. Binance said it had allocated more than $6.34 billion to replace the stolen tokens, with about $3 billion in assets frozen through cooperation with industry partners and law enforcement agencies.

The company also began restoring withdrawal services in phases following the disruption, although the movement of the remaining funds has continued to attract scrutiny from blockchain investigators.

The Binance incident has renewed attention on the growing threat posed by North Korean-linked cyber operations. In February 2025, the FBI attributed the theft of approximately $1.5 billion from cryptocurrency exchange Bybit to TraderTraitor, making the attack one of the largest digital asset breaches before the Binance incident.

The United States and South Korea have repeatedly accused North Korea of using cyber operations to generate foreign currency in the face of international sanctions. Security experts have warned that cryptocurrency theft has become a significant source of illicit revenue for the country, with funds allegedly used to support its economy and weapons programmes.

However, Pyongyang has consistently denied allegations of state involvement in cybercrime, dismissing Washington’s claims as politically motivated.

Kim Yo Jong’s latest statement also warned that North Korea would reconsider certain issues in response to what it described as Washington’s hostile attitude, adding a diplomatic dimension to the dispute as both countries remain at odds over security and nuclear concerns.

The development comes as the global cryptocurrency industry faces mounting pressure to strengthen security measures around digital asset custody, transaction approvals and the movement of funds across blockchain networks.

Meanwhile, the Binance breach has raised fresh questions about the resilience of centralised exchanges, particularly their ability to protect large volumes of customer assets held in online wallets that remain exposed to cyber threats, as disputes between the countries are expected to remain a major focus of international cybersecurity and cryptocurrency regulation.