Kim Yo Jong, sister of North Korean leader Kim Jong Un, publicly denied her country’s involvement in the $6.3 billion Binance hack and suggested, without providing evidence, that the United States may have been responsible for the theft. In a statement released via the Korean Central News Agency (KCNA) on Tuesday, Kim rejected the FBI’s attribution of the attack to a North Korean-backed hacking group, describing the allegations as "absurd rhetoric" and a political provocation intended to damage North Korea’s international standing.
The denial follows recent findings by blockchain intelligence firms, including TRM Labs, Chainalysis, and independent investigator ZachXBT, which linked the Binance breach to North Korean actors with high confidence. TRM Labs cited similarities to previous attacks, such as the use of Tornado Cash and coordinated execution patterns, though noted differences in laundering compared to the February 2025 Bybit hack. The FBI has also previously blamed North Korea for the $1.5 billion Bybit incident, an accusation Kim similarly dismissed.
Kim argued that examining who benefits from the retrieval of stolen cryptocurrency could reveal the true perpetrator, implying US involvement despite offering no proof. Cointelegraph reached out to the FBI for comment regarding these claims.
North Korea’s categorical denial and counter-accusation against the US represent a standard diplomatic maneuver to deflect blame for significant cyber-theft incidents attributed to its state-sponsored groups. By framing the FBI’s findings as politically motivated rather than technically substantiated, Pyongyang seeks to undermine the credibility of Western intelligence agencies and shield itself from further sanctions or reputational damage within the global financial system.
This development highlights the persistent challenge of attributing cybercrimes in decentralized environments where state actors operate with plausible deniability. While blockchain forensics provide strong technical links to North Korean infrastructure, the geopolitical narrative remains contested. Investors and regulators must weigh the robustness of on-chain evidence against the strategic incentives of state-level disinformation campaigns when assessing risk exposure related to exchange security and regulatory compliance.
