North Korea Denies $6.3B Binance Hack, Calls FBI Finding a ‘Political Provocation’

North Korea has rejected U.S. findings that it was behind the record hack of Binance, calling the FBI’s attribution a “grave political provocation,” Yonhap reported on Tuesday.

“It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong, the sister of leader Kim Jong Un, said in a statement carried by the state-run Korean Central News Agency. She called the accusation a “sinister” attempt to damage North Korea’s international image.

Kim also turned the blame back on Washington, pointing to the Trump administration’s plan to use confiscated crypto as a strategic reserve. Anyone who looks at who will end up with “the so-called stolen cryptocurrency” once it is retrieved “may get a clue about who is behind the hacking incident,” she said.

The FBI said on Saturday that North Korean hackers it calls TraderTraitor were responsible for the theft of more than $6 billion from Binance, confirming the attribution blockchain analytics firms TRM Labs and Chainalysis made last week. The FBI attributed the $1.5 billion hack of crypto exchange Bybit in February 2025 to the same group. North Korea has denied previous accusations of hacking.

The hackers are moving their haul quickly. North Korea is laundering the funds at a rate of roughly one new wallet every 25 seconds, across about 12,000 wallets, Decrypt reported on Monday. About $2.85 billion of the $6.43 billion stolen has been frozen or seized, compared with roughly 3% of the funds taken from Bybit.

Not all of the stolen funds are moving at the same pace. As of Monday, more than $1 billion in ETH and about $1.42 billion in BTC had seen limited onward movement, while other funds were moving rapidly across chains, blockchain analytics firm Chainalysis said. The activity so far is broadly consistent with the “immediate layering” phase seen after past North Korean hacks, though funds repeatedly returning to earlier addresses across thousands of transactions suggests automation, the firm said. It expects the scale of the theft to “strain the actors’ trusted laundering channels,” pushing funds toward bridges, instant exchanges and swapping services.

Binance’s recovery

Binance did not respond to the BBC‘s questions about North Korea’s alleged involvement. A company spokesperson told the outlet that a net $4.72 billion had been withdrawn since withdrawals resumed on Sunday, a “relatively limited portion” of total assets of about $157 billion.

By 10 p.m. ET on Monday, hourly deposits were exceeding withdrawals, “reflecting improving user activity and stabilizing flows,” Binance tweeted. The exchange has since restored withdrawals for dozens more tokens on Ethereum and Solana.

Binance also said on Monday that users holding its 10 largest tokens, including BTC, ETH, USDT and USDC, can now verify that their balances are fully backed, using a zero-knowledge proof of its October 31 reserves snapshot. It has covered about 95% of the stolen assets, with the rest made up of less liquid tokens that take longer to buy, and plans to take a wider snapshot on Wednesday.