Pyongyang Rejects FBI Attribution in Record-Breaking Exchange Heist
North Korea has formally repudiated the Federal Bureau of Investigation's finding that a state-linked hacking collective was responsible for the $6.3 billion theft from Binance, the world's largest cryptocurrency exchange. Kim Yo Jong, sister of Supreme Leader Kim Jong Un, released a statement through the Korean Central News Agency on Tuesday in which she dismissed the US agency's conclusions as politically driven rhetoric rather than credible intelligence.
"The FBI is attempting to paint the DPRK as a 'cyber criminal state' by claiming it possesses information that a hacking organization 'supported' by the DPRK was involved in the incident," Kim said, according to the KCNA release. She went on to call the US position "absurd rhetoric and nothing new."
The denial extends beyond the Binance breach. The FBI had also publicly blamed North Korea for the $1.5 billion Bybit hack that occurred in February 2025, and Kim rejected that attribution as well. She characterized both accusations as a recurring pattern in which Washington links Pyongyang to large-scale cyber incidents to damage the country's standing in the international community, without presenting what she considers substantive proof.
Kim Yo Jong Casts Doubt on Washington Involvement
In a notable rhetorical move, Kim suggested—without offering any supporting evidence—that the United States itself could be behind the theft. She urged investigators to trace the destination of the stolen digital assets once they are recovered, arguing that the identity of the beneficiary would reveal the true orchestrator.
No documentary or technical evidence was provided in the KCNA statement to substantiate the claim of US involvement. The FBI has not been publicly quoted in response, and reporting outlets note that they sought comment from the agency without confirming a reply.
For traders and investors who hold positions on centralized exchanges, the episode underscores a persistent concern: that geopolitical attribution disputes can cloud the investigative process for months, leaving victims in limbo while stolen funds move through mixing services and cross-chain bridges.
Blockchain Intelligence Firms Maintain the North Korean Link
Despite Pyongyang's public denial, multiple independent blockchain intelligence organizations have tied the breach to North Korean cyber actors. TRM Labs, in a report issued the week before Kim's statement, attributed the attack to the TraderTraitor group with what it described as high confidence, drawing on both on-chain transaction data and off-chain intelligence.
TRM Labs highlighted several operational hallmarks consistent with prior North Korean campaigns: extensive advance preparation, the use of the Tornado Cash mixer to fund attacker-controlled wallets, and the coordinated replay of previously harvested transaction signatures. The firm did note, however, that the post-theft laundering trajectory differed from the pattern observed after the Bybit incident, suggesting the group may have adapted its money-movement playbook.
Chainalysis and independent on-chain investigator ZachXBT likewise connected the theft to North Korean hackers. ZachXBT went further, identifying a direct link between the Binance and Bitget hacks: stolen funds from both events were routed through THORChain and ultimately commingled at the same wallet address, implying a shared operator or coordination between the two attacks.
During the early days of the Bitget investigation, CEO Gracy Chen told media that preliminary findings pointed to IP addresses routed through VPN services associated with what she described as "a certain DPRK group."
What This Means for Traders and Platform Risk
For the broader trading community, the convergence of a $6.3 billion exchange hack, a disputed $1.5 billion Bybit breach, and a linked Bitget incident raises several practical concerns. First, the sheer scale of the losses—exceeding $7.8 billion across the three events—highlights that even the most prominent centralized platforms remain vulnerable to sophisticated, state-level cyber operations. Second, the geopolitical tug-of-war over attribution means that recovery efforts and potential legal proceedings could be prolonged, reducing the likelihood that affected users will see a return on their holdings.
Traders who allocate capital across crypto exchanges, or who use them as collateral or settlement rails within wider forex and CFD strategies, should treat platform-counterparty risk as a first-order consideration. Diversifying custody, limiting on-exchange balances, and monitoring the regulatory and enforcement landscape around high-profile hacks are prudent steps in an environment where a single breach can erase billions in seconds.