North Korea has officially rejected allegations linking it to a reported $6.3 billion cyberattack targeting cryptocurrency exchange Binance, describing the accusations as politically motivated attempts by the United States to damage Pyongyang’s international reputation. The BBC Urdu reported.
Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un and a senior government official, dismissed the allegations on Tuesday, accusing Washington of repeatedly associating North Korea with international cybercrime without sufficient justification.
The allegations concern a major security breach reported by Binance on October 29, involving digital assets valued at approximately $6.3 billion. The incident has been described as potentially one of the largest cryptocurrency-related cyberattacks on record.
The US Federal Bureau of Investigation (FBI) has attributed the operation to TraderTraitor, a hacking group linked to North Korea. Blockchain intelligence companies TRM Labs and Chainalysis have also identified similarities between the incident and previous cyber operations attributed to North Korean-linked hackers.
Pyongyang has consistently denied involvement in international cyberattacks.
Meanwhile, Binance says it has covered approximately 95% of the affected assets using its own financial resources and remains committed to compensating users for the full value of their losses.
The incident has renewed concerns about the vulnerability of cryptocurrency infrastructure, the growing sophistication of state-linked cyber operations and the challenges facing international authorities attempting to trace and recover stolen digital assets.
North Korea Rejects US Allegations Over Binance Hack
North Korea’s response came through Kim Yo Jong, director of the General Affairs Department, who criticised Washington for linking the country to the Binance incident.
In her statement, she described the US accusations as another attempt to associate the Democratic People’s Republic of Korea with international cybercrime.
Kim argued that presenting North Korea as responsible for cyber incidents around the world amounted to a political provocation intended to undermine the country’s reputation.
She also reiterated Pyongyang’s position that its government opposes malicious cyber activities.
North Korea has repeatedly rejected similar accusations following major cryptocurrency thefts and other cyber incidents attributed to groups allegedly operating under its direction.
However, US intelligence and law enforcement agencies have continued to identify North Korean-linked hacking networks as significant threats to the international financial and digital infrastructure.
The distinction between an allegation and an established finding remains important. While the FBI and blockchain analytics companies have presented evidence linking the Binance incident to TraderTraitor, North Korea denies the accusations.
The attribution of sophisticated cyberattacks generally involves examining digital transaction patterns, malware characteristics, infrastructure, operational methods and connections with previously identified hacking networks.
A final determination of responsibility requires a comprehensive assessment of the available technical and investigative evidence.
FBI Identifies TraderTraitor as Suspected Attack Group
The FBI has attributed the Binance incident to TraderTraitor, a cybercrime group associated with North Korea.
The group has also been identified in previous investigations involving cryptocurrency thefts. It is frequently discussed alongside the broader Lazarus Group network, although different operational names and subgroups should not automatically be treated as identical organisations.
Following the Binance incident, the FBI urged cryptocurrency exchanges, blockchain service providers and other industry participants to identify and block transactions connected to cryptocurrency wallets associated with the suspected hackers.
The objective is to prevent stolen assets from being transferred through multiple platforms, converted into other digital currencies or moved beyond the reach of investigators.
Blockchain technology provides a public transaction record that can help investigators trace the movement of digital assets. However, identifying wallet addresses does not necessarily establish the identity of the individuals controlling them.
Cryptocurrency criminals can also attempt to obscure transaction trails through multiple wallets, cross-chain transfers and other laundering techniques.
The FBI’s involvement highlights the growing importance of international cooperation between law enforcement agencies, financial institutions and private blockchain intelligence companies.
For cryptocurrency platforms, cooperation with investigators has become an increasingly important component of cybersecurity and financial crime prevention.
Binance Hack: How the Attack May Have Happened
Binance’s preliminary investigation indicated that the security breach may have originated through the compromised laptop of an engineer working for the company.
Co-CEO Richard Teng said the incident involved unauthorised access to a service container, which allegedly enabled the attackers to approve unauthorised asset transfers.
However, Teng cautioned against interpreting the incident as a simple case of an employee’s permissions being misused.
He explained that the attack involved a considerably more complex method and was not simply a one-click operation.
According to Binance, investigators had not identified a single individual responsible for the incident. The company also said it had found no evidence that private keys associated with its wallets had been exposed.
Subsequent company statements indicated that the security breach was not necessarily confined to a single point of access.
Binance said its investigation was continuing and that further information would be shared as additional findings became available.
The incident highlights an important development in cybersecurity: attackers increasingly target the systems, employees and software infrastructure that control access to valuable digital assets rather than relying exclusively on stealing private keys.
A compromised employee device, vulnerable software service or poorly protected internal permission system can potentially create opportunities for unauthorised financial transactions.
For cryptocurrency exchanges, this means that security measures must extend beyond wallet encryption and password protection.
Internal access controls, employee devices, transaction approval procedures, network monitoring and emergency response systems are equally important.
Binance Says 95% of Affected Assets Have Been Covered
Binance has sought to reassure customers by committing to cover the full financial impact of the incident.
The company said it had allocated more than $6.3 billion from its own resources to compensate for the affected assets.
According to its November 2 update, approximately 95% of the affected asset value had been covered.
The remaining portion involved certain cryptocurrencies that require additional time to obtain in the necessary quantities because of their relatively limited market liquidity.
Binance said it had restored the value of several major digital assets, including Bitcoin, Ethereum, Tether, BNB, Solana, USDC and XRP.
The company also referred to its Proof of Reserves system, which allows customers to examine information about the assets held against customer balances.
In an earlier statement, Binance said it was working with blockchain partners to freeze affected digital assets. The company reported that approximately $3 billion worth of assets had been frozen on-chain.
However, freezing stolen cryptocurrency and replacing the financial value of affected customer assets are two separate processes.
Frozen assets may remain inaccessible to suspected attackers, but their recovery and eventual return to their rightful owners can involve additional legal and technical procedures.
Binance has maintained that customers will not bear the financial burden of the incident.
The company’s response is significant because confidence in cryptocurrency exchanges depends heavily on their ability to protect customer funds and maintain operational continuity during major security incidents.
Nevertheless, the full financial consequences will depend on the eventual recovery of stolen assets, the company’s final investigation and the effectiveness of its revised security arrangements.
Bybit Cyberattack Raises Concerns About North Korean Hacking Networks
The Binance incident follows another major cryptocurrency theft involving Bybit in February 2025.
Approximately $1.5 billion in digital assets was stolen from the cryptocurrency exchange in an attack that US authorities also attributed to North Korean-linked hackers.
The Bybit incident was considered one of the largest cryptocurrency thefts at the time.
The alleged $6.3 billion Binance incident would represent a substantially larger financial impact if the reported valuation and attribution are confirmed.
North Korea has faced international accusations for years over cyber operations targeting financial institutions, cryptocurrency exchanges and other digital infrastructure.
Western governments and cybersecurity agencies have argued that cryptocurrency theft provides an alternative source of revenue for Pyongyang, whose economy faces extensive international sanctions.
Some investigations have also linked proceeds from North Korean cyber operations to the country’s weapons development and missile programmes.
Research institutions, including Singapore’s S. Rajaratnam School of International Studies, have examined how North Korea developed its cyber capabilities through specialised technical education, talent recruitment and intelligence-linked operational units.
These assessments suggest that North Korea has invested in developing a trained cyber workforce capable of operating internationally.
However, claims about the destination of stolen funds must be assessed separately from allegations about responsibility for individual attacks.
It would therefore be premature to conclude that the entire amount associated with the Binance incident has been transferred to or used by North Korea’s government.
Global Cryptocurrency Industry Faces a New Security Challenge
The Binance incident has raised broader questions about the security of the international cryptocurrency ecosystem.
The involvement of major exchanges, blockchain networks, stablecoin issuers and financial technology companies demonstrates how interconnected the industry has become.
Following the incident, major digital asset companies, including Tether and Circle, reportedly froze approximately $2.4 billion worth of assets collectively in connection with the response to the suspected theft.
World Liberty Financial also said it had worked with partners to help freeze stolen funds.
Meanwhile, Coinbase stated that its platform was not affected by the incident and that it was monitoring developments.
These responses demonstrate the importance of cooperation between competing cryptocurrency businesses when dealing with large-scale financial crime.
They also highlight a significant characteristic of blockchain-based financial systems: while transactions can be publicly tracked, stopping or reversing unauthorised transfers is not always straightforward.
Stablecoin issuers may have technical mechanisms to freeze certain tokens under specific circumstances, while decentralised digital assets generally present different recovery challenges.
The involvement of private companies in freezing digital assets also raises questions about governance, regulatory oversight and the balance between security and decentralisation.
For governments and regulators, the challenge is to develop effective international standards without undermining legitimate technological innovation.
A Major Test for Global Cybersecurity Cooperation
The Binance cyberattack has developed into a major international security issue, combining allegations of state-linked cybercrime, financial losses and growing concerns about the resilience of cryptocurrency infrastructure.
North Korea has rejected the accusations, while the FBI and blockchain intelligence companies have linked the incident to the TraderTraitor hacking network.
Binance’s decision to cover approximately 95% of the affected asset value represents an important response to the financial consequences, but the recovery of stolen funds and the final determination of responsibility remain separate challenges.
For the international cryptocurrency industry, the incident demonstrates that even large platforms with substantial financial resources can face sophisticated security threats.
For Pakistan and other emerging digital economies, the message is equally significant: financial innovation must be accompanied by stronger cybersecurity, institutional accountability and international cooperation.
As digital assets become increasingly integrated into global financial activity, the ability to prevent cyberattacks, trace illicit transactions and protect customer funds will become a defining measure of trust in the digital economy.
Dr. Mohammad Arif is a senior researcher who keeps a close eye on Asian affairs, especially China, Korea, Russia and Central Asia.
