Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied North Koreas involvement in the $6.3 billion Binance hack and appeared to suggest, without evidence, that the US could have been behind the theft.
In a statement released via the Korean Central News Agency (KCNA) on Tuesday, Kim rejected the FBIs attribution of the attack to a North Korean-backed hacking group.
“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” said Kim. “But the US assertion is an absurd rhetoric and nothing new.”
She described the allegations as a political provocation intended to damage North Koreas international standing. The FBI also blamed North Korea for the $1.5 billion Bybit hack in February 2025, an accusation Kim also rejected on Tuesday.
“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” said Kim.
Kim casts suspicion on US over Binance hack
Kim has also pointed the finger at the US for involvement in the hack, without supplying any evidence.
“If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident,” she said.
The statement provided no evidence connecting Washington to the attack. Cointelegraph reached out to the FBI for comment.
She maintained that North Korea opposes malicious activity in cyberspace and accused the US of politicizing cybersecurity to interfere in other countries affairs.
Investigators cite links to earlier North Korean hacks
Last week, blockchain intelligence firm TRM Labs attributed the Binance attack to North Koreas TraderTraitor group with high confidence, citing onchain and offchain intelligence. Other investigators, including Chainalysis and ZachXBT, also linked the theft to North Korean hackers.
TRM Labs pointed to similarities with previous North Korean attacks, including advance preparation, the use of Tornado Cash to fund attacker wallets and the coordinated execution of previously obtained transaction signatures. However, it said the laundering activity differed from the pattern following the Bybit hack.
Onchain investigator ZachXBT also identified a connection between the Binance and Bitget hacks, saying stolen funds from both incidents were commingled at the same address after passing through THORChain. During early investigation into the hack, Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used “by a certain DPRK group.”