North Korea Denies $6.3bn Binance Hack — SkimNews
Get the Geopolitics newsletter
Daily geopolitics — wars, elections, sanctions, the diplomatic moves that move markets. Free.
- North Korea denied being behind the record $6.3bn (£4.7bn) hack of cryptocurrency exchange Binance, calling the accusations "absurd rhetoric".
- Kim Yo Jong, a top DPRK official and sister of leader Kim Jong Un, said on Tuesday the accusations are another "sinister attempt" by the US to damage Pyongyang's public image, and called the US move "a grave political provocation" that misleads international public opinion.
- FBI — alongside the Secret Service and cyber analysts — said North Korea orchestrated the hack, described as the largest in history, with blockchain analysts and the FBI attributing the attack to the state-backed group TraderTraitor.
- TraderTraitor, also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025, and the FBI has called on industry partners to help block transactions involving cryptocurrency accounts linked to the group.
- Binance said initial checks indicated that an engineer's laptop was compromised, enabling an attacker to make unauthorised withdrawals; trading in major cryptocurrencies has since resumed after the exchange worked with issuers to freeze assets impacted by the hack.
- Binance posted data on Tuesday showing a net $5.27bn has been withdrawn from the exchange since transactions resumed on Sunday and transaction levels have stabilised, and said it will cover all losses — around 95% of the assets stolen so far.
- S Rajaratnam School of International Studies said North Korea recruits promising students from universities and sends them to hacker units overseen by the country's intelligence agency, detailing how Pyongyang has systematically built its cyber operations while the country has been accused of relying on cyber-crime to help finance its sanctioned economy.
Why it matters: Two consequences are already concrete: a net $5.27bn has left Binance since trading resumed Sunday, and the exchange has covered about 95% of the assets stolen. The attribution fight still has teeth, because the FBI has asked industry partners to block TraderTraitor-linked accounts — pressing crypto intermediaries to act on a claim Pyongyang rejects.
Ask SkimNews
