Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, has strongly denied Pyongyang’s involvement in the historic $6.3 billion Binance cryptocurrency hack. In a striking counter-accusation, she appeared to suggest, without providing any supporting evidence, that the United States itself could be the hidden force behind the massive digital asset theft.
The denial was issued through an official statement published by the Korean Central News Agency (KCNA) on Tuesday. In her remarks, Kim formally rejected the official attribution made by the Federal Bureau of Investigation (FBI), which publicly blamed North Korean state-backed threat actors for orchestrating the record-breaking cyberattack.
“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” Kim stated in the KCNA release, referring to North Korea by its official name, the Democratic People’s Republic of Korea. “लेकिन [Translation/Context: But] the US assertion is an absurd rhetoric and nothing new.”
Kim characterized the accusations as a calculated political provocation designed to erode North Korea’s international standing and diplomatic reputation. Furthermore, her Tuesday statement also rejected a separate accusation from the FBI linking North Korea to another massive digital heist: the $1.5 billion Bybit hack that took place in February 2025.
“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” Kim added, maintaining a defiant posture against mounting global scrutiny.
Kim casts suspicion on US over Binance hack
Beyond merely denying Pyongyang’s participation in the breach, Kim turned the narrative around, pointing a suspicious finger directly at Washington without offering any verifiable proof or documentation to substantiate her claims.
“If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident,” she remarked, suggesting a convoluted financial motive that allegedly points away from her country and toward Western authorities.
Despite the severity of her implication connecting Washington to the cyberattack, the official statement failed to provide any concrete evidence. In the wake of these remarks, media organizations, including Cointelegraph, reached out to the FBI for formal comment regarding the counter-allegations.
Throughout her statement, Kim maintained that North Korea fundamentally opposes all forms of malicious activity in cyberspace. She asserted that the United States is routinely politicizing international cybersecurity issues as a pretext to interfere in the sovereign internal affairs of other nations and to wage an ongoing propaganda campaign against Pyongyang.
Investigators cite links to earlier North Korean hacks
Kim’s sweeping denials stand in stark contrast to a growing mountain of digital forensic evidence compiled by prominent independent cybersecurity and blockchain intelligence firms. Just last week, blockchain intelligence firm TRM Labs publicly attributed the massive Binance breach to North Korea’s notorious TraderTraitor hacking collective with a high degree of confidence. According to TRM Labs, their conclusion was drawn from a meticulous analysis of both on-chain and off-chain intelligence gathered in the aftermath of the theft.
Other leading blockchain forensics investigators, including Chainalysis and the well-known on-chain sleuth ZachXBT, have independently corroborated these findings, directly tying the multi-billion-dollar theft to North Korean cyber operatives.
TRM Labs highlighted distinct technical similarities between the Binance attack and previous operations historically attributed to Pyongyang. These operational markers included extensive advance preparation, the strategic deployment of the privacy-enhancing mixer Tornado Cash to obscure attacker wallets, and the highly coordinated execution of previously obtained transaction signatures. However, investigators noted that the specific laundering activity observed following the Binance incident did exhibit some operational variations when compared to the distinct patterns that emerged after the Bybit hack earlier in the year.
Further complicating the investigative web, independent on-chain investigator ZachXBT identified a direct digital nexus linking the Binance hack to an earlier security breach at Bitget. According to ZachXBT’s findings, stolen funds originating from both distinct incidents were eventually commingled at the exact same destination address after being routed through THORChain to mask their trails.
During the preliminary stages of the investigation into the Bitget incident, Bitget CEO Gracy Chen publicly stated that early internal findings had successfully traced internet protocol (IP) addresses connected to the breach back to virtual private network (VPN) services known to be utilized routinely by specific DPRK-affiliated threat groups. As international law enforcement agencies and private sector blockchain analysts continue to track the movement of the dispersed digital funds, the diplomatic war of words between Pyongyang and Washington highlights the escalating and increasingly complex geopolitical dimensions of global cryptocurrency security.
Comments (0)