North Korea Denies Involvement in $6.3 Billion Binance Hack

North Korea has denied responsibility for the record $6.3 billion hack of cryptocurrency exchange Binance, dismissing accusations as a political provocation. The FBI, Secret Service, and cyber analysts attribute the attack to TraderTraitor, a North Korean state-backed hacking group also known as the Lazarus Group, which previously carried out a $1.5 billion hack of Bybit in 2025. The hack, which occurred on October 29, 2026, involved the theft of funds across ten blockchains in approximately 20 minutes, with Ethereum bearing the heaviest losses at $3.8 billion. Binance has committed $6.34 billion of its own reserves to cover user losses, replacing 90% of stolen tokens and restoring withdrawals by Sunday, though net outflows reached $4.7 billion by Monday morning. Kim Yo-jong, a top North Korean official, called the US claims “absurd rhetoric” and a “grave political provocation,” echoing past denials of similar accusations. The FBI has urged industry partners to help block transactions linked to the group, noting that the hackers began converting stolen assets primarily into Ethereum.

Blockchain analysts and the FBI say the attack began with a compromised laptop belonging to a Binance DevOps engineer, granting access to internal services and allowing unauthorized withdrawal transactions. The hackers had reportedly prepared for the attack days in advance, collecting transaction signatures.

While Binance has largely focused on the technical response to the breach, the incident has prompted scrutiny of the security of cryptocurrency exchanges and the ongoing threat posed by state-sponsored hacking groups.

Where they differ

• Latin Times detailed the technical specifics of the hack, including the compromised laptop and the speed of the theft (20 minutes, 10 blockchains).
• Japan Times highlighted the $4.7 billion in net outflows from Binance following the hack, while BBC and Latin Times did not emphasize this figure.
• BBC focused on Kim Yo-jong’s statement as a direct denial, while Japan Times framed it within the context of potential US-North Korea talks.

What is not yet known

• The full extent of the Lazarus Group's capabilities and future targets remains unclear.
• Whether the US will pursue further diplomatic or economic pressure on North Korea in response to the hack is not stated.

Background

• North Korea has a history of denying involvement in cyberattacks, even when evidence points to state-backed groups like the Lazarus Group, which was previously linked to a $1.5 billion hack of Bybit in 2025 [Fact Refinery, 2026-11-02].
• The Lazarus Group, also known as TraderTraitor, is identified by US authorities as a North Korean cybercrime group [Fact Refinery, 2026-11-02].
• Kim Yo-jong is a high-ranking North Korean official who has previously issued denials of accusations against her country, often framing them as political provocations [Fact Refinery, 2026-10-22].
• North Korea recently strengthened ties with China, demonstrated by Kim Jong Un’s visit and the opening of a new bridge between the two countries [Fact Refinery, 2026-10-24].

Our reading

Our reading is that North Korea’s denial of involvement in the Binance hack appears to follow a pattern of dismissing accusations of cybercrime as politically motivated. The swiftness of the denial, delivered through a top official, suggests a prepared response aimed at deflecting blame and potentially influencing ongoing geopolitical discussions, as indicated by the Japan Times’ framing of the statement. While Binance has taken steps to mitigate the financial impact, the incident highlights the vulnerability of cryptocurrency exchanges to state-sponsored hacking and the potential for significant financial disruption.

What to watch

• Whether the FBI releases further evidence linking TraderTraitor/Lazarus Group to the Binance hack, specifically detailing the compromised laptop and transaction signatures [FBI website].
• If the US government announces any new diplomatic or economic measures targeting North Korea in response to the hack, or if they remain focused on technical countermeasures [US State Department website].
• Future reports on net outflows from Binance and other cryptocurrency exchanges, which could indicate ongoing market instability or further attacks [Blockchain analytics firms like Derive.xyz].

Was this useful? 👍 0 👎 0

---

Read the original coverage