North Korea has denied stealing more than $6 billion in crypto from Binance. In a statement carried by the state's Korean Central News Agency (KCNA) on Tuesday, Kim Yo Jong, the sister of leader Kim Jong Un, rejected the FBI's finding that a North Korean-backed hacking group carried out the theft. She also suggested, without offering evidence, that the US could be behind it.

The denial does not touch the evidence that tied the hack to Pyongyang, and the statement offers nothing that links Washington to the attack. Its real target is the recovery. Kim pointed readers at whoever ends up holding the stolen coins once they are retrieved, which turns a question about hackers into a question about who keeps the money.

Kim Ties the Accusation to a US Crypto Reserve

Kim linked the FBI's finding to the current US administration's plan to hold seized crypto. "As soon as the present U.S. administration took office last year, it announced that it would confiscate illegally stolen cryptocurrency assets and use them as a state's strategic reserve," she said.

Anyone who looks at who will end up with "the so-called stolen cryptocurrency" once it is retrieved, she said, "may get a clue about who is behind the hacking incident."

She called the attribution "a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds." It is rare for Kim to issue a statement on a hacking incident.

The statement also carried a warning. "We have issues to reconsider in diverse aspects as regards the very unpleasant U.S. hostile attitude," Kim said. She did not say what those issues are.

The Bybit Finding Rejected Too

Kim's denial went beyond Binance. The FBI also blamed North Korea for the $1.5 billion Bybit hack in February 2025, and Kim rejected that attribution on Tuesday as well.

What the FBI and Investigators Found

The FBI announced on Saturday that North Korea was responsible for the Binance theft and linked it to TraderTraitor, a North Korean hacking group.

Private blockchain investigators reached the same conclusion. TRM Labs attributed the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence. It pointed to two signs:

  • Tornado Cash, a crypto mixing service, was used to fund the attacker wallets.
  • The attackers executed transaction signatures they had obtained in advance, in a coordinated way.

TRM also said the laundering that followed did not match the pattern seen after the Bybit hack. Chainalysis and on-chain investigator ZachXBT also linked the theft to North Korean hackers.

ZachXBT went a step further. He said funds stolen from Binance and from the Bitget hack passed through THORChain, a cross-chain swap protocol, and were then mixed together at the same address. That claim has not been independently checked on-chain.

What to Watch After the Denial

Kim's framing matters for one reason: the recovery fight is not over. If more of the stolen funds are frozen or seized, Pyongyang has already set out its line, that whoever ends up holding them is the real culprit.

No FBI response to Kim's statement has been confirmed so far. The other open question is what she meant by "issues to reconsider", and whether Pyongyang follows the words with any action.