North Korea Denies Involvement in Record $6.3 Billion Binance Cyberattack

North Korea has rejected allegations that it was responsible for a record-breaking cyberattack targeting cryptocurrency exchange Binance, dismissing accusations from US authorities as politically motivated.

Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a senior government official, issued the denial on Tuesday. She described the allegations as an attempt by the United States to damage North Korea’s international reputation.

The denial comes after the Federal Bureau of Investigation (FBI), the US Secret Service and blockchain security analysts reportedly linked the $6.3 billion Binance incident to North Korean state-backed hackers. The attack has been described as one of the largest cryptocurrency-related cyber incidents on record.

North Korea Rejects US Allegations

In an official statement, Kim Yo Jong accused Washington of repeatedly associating North Korea with cybercrime without sufficient justification.

She said the allegations represented a political provocation and criticized what she described as an attempt to influence international public opinion against Pyongyang.

North Korea has consistently denied accusations that its government supports or carries out cyberattacks. However, US authorities and cybersecurity researchers have repeatedly identified North Korean-linked groups in investigations involving cryptocurrency theft and other major digital incidents.

The latest dispute highlights the difficulty of investigating state-sponsored cybercrime, particularly when the accused government rejects the findings.

TraderTraitor and Lazarus Group Linked to the Attack

US investigators and blockchain analysts have attributed the Binance incident to TraderTraitor, a hacking operation associated with North Korea.

The group is also linked to the broader North Korean cyber threat landscape, which includes the well-known Lazarus Group. These operations have been associated with cryptocurrency theft, financial fraud and attacks against organizations around the world.

North Korean-linked hackers have previously been accused of targeting cryptocurrency platforms to obtain funds that can be moved through complex networks of digital wallets and laundering services.

One major example was the 2025 attack on cryptocurrency exchange Bybit, in which approximately $1.5 billion in digital assets was stolen. The incident was attributed to North Korean hackers and demonstrated the scale of financial damage that sophisticated cryptocurrency attacks can cause.

North Korea has denied responsibility for such incidents.

FBI Calls for Action Against Cryptocurrency Wallets

Following the Binance incident, the FBI called on cryptocurrency industry participants to help identify and block transactions connected to accounts associated with TraderTraitor.

Cooperation between exchanges, blockchain analytics companies and law enforcement agencies is an important part of responding to cryptocurrency theft.

Unlike traditional financial transactions, cryptocurrency transfers can move across multiple blockchain networks and wallets. Investigators can often trace these transactions publicly, but identifying the people controlling the wallets and preventing funds from being moved can be considerably more difficult.

Freezing stolen assets may also require cooperation from cryptocurrency exchanges and token issuers that have the technical ability to restrict certain transactions.

Binance Reports Billions in Withdrawals After the Incident

The security incident has also affected activity on Binance, one of the world’s largest cryptocurrency exchanges.

According to the company’s spokesperson, Binance recorded approximately $4.72 billion in net withdrawals after trading resumed on Sunday. The company described the outflows as a relatively limited portion of its total assets, which were valued at approximately $157 billion.

Binance said withdrawal activity was beginning to return to normal levels.

The exchange also provided an initial explanation of how the breach occurred. Its early investigation indicated that an engineer’s laptop had been compromised, allowing an attacker to carry out unauthorized withdrawals.

Trading in major cryptocurrencies resumed after Binance worked with asset issuers to freeze affected funds.

The company has also stated that it would cover the losses associated with the incident, reporting that approximately 95% of the stolen assets had already been covered at the time of the BBC report.

It is important to distinguish the reported $6.3 billion attack figure from the $4.72 billion in net withdrawals. The latter reflects customer activity following the incident and does not necessarily represent additional funds stolen by attackers.

Why Cryptocurrency Exchanges Remain High-Value Targets

The Binance incident highlights the security challenges facing cryptocurrency exchanges and the wider digital asset industry.

Large exchanges manage substantial amounts of digital assets and depend on complex systems involving employee devices, authentication controls, transaction approvals and cryptocurrency wallets. A weakness in any part of this infrastructure can create opportunities for attackers.

Several security practices can help reduce these risks:

• Secure employee devices: Work laptops should use endpoint protection, security updates and strict access controls.
• Strengthen authentication: Multi-factor authentication and phishing-resistant security keys can make account compromise more difficult.
• Protect transaction approvals: Large withdrawals should require multiple independent approvals and additional verification.
• Monitor blockchain activity: Exchanges should detect unusual transactions and suspicious withdrawal patterns.
• Prepare incident response procedures: Organizations need clear processes for investigating breaches, freezing assets where possible and communicating with customers.

Cryptocurrency platforms also need to consider insider access, compromised employee accounts and supply-chain vulnerabilities when reviewing their security strategies.

A Continuing Challenge for Global Cybersecurity

North Korea’s denial adds another political dimension to an incident that has already raised serious questions about cryptocurrency security.

While US authorities and blockchain analysts have attributed the attack to North Korean-linked hackers, Pyongyang continues to reject allegations of government involvement.

The incident also demonstrates how cyberattacks against cryptocurrency platforms can create consequences far beyond the initial security breach. Exchanges must protect digital assets, maintain customer confidence and coordinate with international authorities when stolen funds move across blockchain networks.

As cryptocurrency adoption continues, securing exchanges and the infrastructure supporting digital assets will remain a major challenge for the global cybersecurity industry.