North Korea Rejects $6.3B Binance Hack Accusation, Cites FBI 'Political Provocation'

North Korea has vehemently denied accusations that it was behind the record-breaking hack of cryptocurrency exchange Binance, labeling the U.S. Federal Bureau of Investigation’s attribution a “grave political provocation.”

Denials and Counter-Accusations

Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, issued a statement carried by the state-run Korean Central News Agency, asserting that the U.S. is misleading international public opinion by falsely attributing cybercrimes worldwide to Pyongyang. She characterized the accusation as a “sinister” effort to tarnish North Korea’s international image.

Kim Yo Jong also turned the tables on Washington, referencing the Trump administration’s plan to utilize confiscated cryptocurrency as a strategic reserve. She suggested that an examination of who ultimately benefits from “the so-called stolen cryptocurrency” once it is recovered could reveal the true perpetrators of the hacking incident.

FBI’s Attribution and Previous Incidents

The FBI stated on Saturday that North Korean hackers, identified as “TraderTraitor,” were responsible for the theft of over $6 billion from Binance. This attribution was corroborated by blockchain analytics firms TRM Labs and Chainalysis last week. The FBI had previously linked the same group to a $1.5 billion hack of crypto exchange Bybit in February 2025. North Korea has a history of denying hacking allegations.

Funds Laundering Operations

According to a report by Decrypt on Monday, the hackers are rapidly moving the stolen funds. North Korea is reportedly laundering the money at a pace of approximately one new wallet every 25 seconds, utilizing around 12,000 wallets. Of the $6.43 billion stolen, about $2.85 billion has been frozen or seized, a stark contrast to the roughly 3% of funds taken from the Bybit hack that were recovered.

Movement of Stolen Assets

Blockchain analytics firm Chainalysis noted that the stolen funds are not all progressing through the laundering process at the same speed. As of Monday, over $1 billion in Ether (ETH) and approximately $1.42 billion in Bitcoin (BTC) had shown limited onward movement. Meanwhile, other funds were being rapidly transferred across different blockchain networks. Chainalysis indicated that this activity is consistent with the “immediate layering” phase observed in previous North Korean hacks. However, the firm also pointed out that funds repeatedly returning to earlier addresses across thousands of transactions suggests the use of automation. Chainalysis anticipates that the sheer scale of this theft will “strain the actors’ trusted laundering channels,” likely pushing funds towards bridges, instant exchanges, and swapping services.

Binance’s Response and Recovery Efforts

Binance did not respond to inquiries from the BBC regarding North Korea’s alleged involvement. A company spokesperson informed the outlet that a net $4.72 billion had been withdrawn since withdrawals resumed on Sunday, describing this as a “relatively limited portion” of the exchange’s total assets, which stand at approximately $157 billion.

By 10 p.m. ET on Monday, hourly deposits had begun to exceed withdrawals, which Binance tweeted indicated “improving user activity and stabilizing flows.” The exchange has since restored withdrawals for dozens more tokens on the Ethereum and Solana networks.

On Monday, Binance also announced that users holding its 10 largest tokens, including BTC, ETH, USDT, and USDC, can now verify that their balances are fully backed. This verification is made possible through a zero-knowledge proof of its October 31 reserves snapshot. The exchange has covered about 95% of the stolen assets, with the remaining portion consisting of less liquid tokens that require more time to acquire. Binance plans to conduct a broader snapshot of its reserves on Wednesday.