Key Takeaways
- North Korea denied responsibility for the $6.3 billion Binance hack, with Kim Yo-jong calling the FBI’s accusations a “grave political provocation” intended to damage the country’s reputation.
- The FBI attributed the attack to North Korea’s TraderTraitor hacking group, while blockchain investigators including TRM Labs, Chainalysis, and ZachXBT independently linked the theft to North Korean hackers.
- Investigators traced stolen funds through approximately 12,000 wallets across 11 blockchains, involving more than 40,000 transactions, as authorities and cryptocurrency firms work to track and potentially recover the assets.
North Korea Slams FBI for Binance Blame
Kim Yo-jong dismissed the FBI’s findings Tuesday, describing Washington’s attribution of the Oct. 29 attack to North Korean hackers as a “grave political provocation,” according to a Yonhap News Agency report citing a statement published by the state-run Korean Central News Agency (KCNA).
The FBI on Saturday identified TraderTraitor, a North Korean state-sponsored hacking operation associated with the Lazarus Group, as responsible for stealing more than $6 billion in digital assets from Binance, the world’s largest cryptocurrency exchange.
Kim accused U.S. authorities of attempting to portray North Korea as a cybercriminal state while unfairly holding it responsible for hacking incidents worldwide.
She claimed the allegations were intended to damage North Korea’s international reputation and constituted an infringement of its sovereignty in cyberspace. Kim also suggested that Washington could have ulterior motives related to recovering the stolen cryptocurrency.
“As soon as the present U.S. administration took office last year, it announced that it would confiscate illegally stolen cryptocurrency assets and use them as a state’s strategic reserve,” she said.
Kim suggested that examining who ultimately benefits from recovered funds could provide clues about the perpetrators, without presenting evidence supporting that implication. North Korea has repeatedly denied responsibility for crypto thefts attributed to state-backed hackers. However, Yonhap noted that Kim’s direct intervention in a dispute over a hacking incident was unusual.
The denial comes after several blockchain intelligence companies independently linked the Binance theft to North Korean cybercriminals.
As Bitcoin.com News previously reported, TRM Labs attributed the attack to TraderTraitor with high confidence, citing blockchain activity and intelligence gathered outside public networks. Independent investigator ZachXBT also identified North Korea’s Lazarus Group—which has been linked to TraderTraitor—as the likely perpetrator.
Chainalysis subsequently strengthened that assessment after identifying connections between funds stolen from Binance and assets associated with a September attack on Bitget that had previously been attributed to North Korean hackers.
Binance Recovers From Record Crypto Hack
The Binance breach, which investigators have valued at approximately $6.3 billion, is the largest cryptocurrency theft on record. The attack involved unauthorized transfers across several blockchain networks, including Ethereum and Bitcoin.
Binance initially suggested that a compromised employee laptop might have facilitated the incident, but subsequent investigations uncovered additional security breaches. The exchange said it found no evidence that its wallet private keys had been leaked and pledged to cover the losses.
The attackers have since employed an extensive network of cryptocurrency wallets to move the proceeds and complicate recovery efforts.
Blockchain analytics firm Elliptic traced stolen assets through approximately 12,000 wallets spanning 11 blockchains in fewer than four days. The firm identified more than 40,000 transactions, although it estimated that only a negligible portion of the proceeds had been converted into cash.
The FBI has urged cryptocurrency exchanges and other digital asset businesses to block transactions associated with the attackers’ identified wallets. Binance said that almost $3 billion worth of stolen funds were frozen by stablecoin issuers and other exchanges, making it impossible for the attackers to move or trade them. USDT issuer Tether said it alone froze over $1.5 billion worth of the leading stablecoin within 30 minutes of suspicious flows being reported.
Kim concluded her statement by warning that Pyongyang was closely watching Washington’s actions and could reconsider aspects of its response to what it characterized as continued U.S. hostility.
