North Korea has formally denied responsibility for the massive cyberattack on cryptocurrency exchange Binance, dismissing U.S. government accusations as a "grave political provocation." Kim Yo Jong, sister of leader Kim Jong Un, stated via the state-run Korean Central News Agency that the allegations are a sinister attempt to damage the country's international image. In a counter-accusation, Kim pointed to the Trump administration’s plan to utilize confiscated digital assets as a strategic reserve, suggesting that those who would ultimately control the recovered funds might hold the key to identifying the true perpetrators.
The denial follows an announcement by the FBI on Saturday attributing the theft of more than $6 billion from Binance to TraderTraitor, a North Korean hacking group previously linked to the February 2025 Bybit hack. Blockchain analytics firms TRM Labs and Chainalysis corroborated this attribution last week. Despite North Korea's rejection, technical data indicates rapid movement of the stolen assets, with laundering occurring through approximately 12,000 wallets at a rate of one new wallet every 25 seconds. Currently, about $2.85 billion of the total stolen amount has been frozen or seized.
Meanwhile, Binance is working to stabilize its platform following the breach. The exchange reported that net withdrawals reached $4.72 billion since services resumed on Sunday, representing a limited portion of its total assets. However, user confidence appears to be recovering, as hourly deposits began to exceed withdrawals late Monday evening. Binance has restored withdrawal capabilities for dozens of tokens on Ethereum and Solana and implemented zero-knowledge proofs allowing users to verify that their balances in major tokens like BTC and ETH are fully backed.
North Korea's denial introduces a layer of geopolitical complexity to what was otherwise a straightforward attribution by law enforcement and blockchain analysts. By pivoting the narrative toward U.S. policy regarding confiscated crypto reserves, Pyongyang attempts to frame the accusation as politically motivated rather than factually grounded. This rhetorical strategy aims to undermine the credibility of the FBI's findings among international audiences skeptical of Western intelligence claims, potentially complicating diplomatic efforts to recover the stolen assets.
From an operational risk perspective, the speed at which funds are being laundered highlights the limitations of current tracking mechanisms against sophisticated, automated criminal networks. While Binance's recovery of deposit flows suggests short-term market stabilization, the sheer volume of unseized funds moving across chains poses a long-term threat to liquidity and trust. The incident underscores the urgent need for enhanced cross-border cooperation between exchanges, analytics firms, and regulators to disrupt the infrastructure used for large-scale crypto theft.
