North Korea Dismisses Claims of Involvement in $6.3 Billion Binance Hack

North Korea has strongly denied allegations connecting the nation to the $6.3 billion (£4.7 billion) cyberattack on cryptocurrency exchange Binance, dismissing the accusations made by U.S. authorities and security researchers as unfounded political maneuvers.

Kim Yo Jong, director of North Korea's General Affairs Department and sister of leader Kim Jong Un, issued a statement via the state-run Korean Central News Agency (KCNA) rejecting claims from the U.S. Federal Bureau of Investigation (FBI), the Secret Service, and cybersecurity firms linking Pyongyang to the breach:

 "The US has made a trite provocation of linking it with the Democratic People's Republic of Korea again. It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.”

U.S. law enforcement agencies and blockchain analytics providers including Chainalysis, Elliptic, and TRM Labs have attributed the heist to TraderTraitor, a state-backed hacking unit also known as the Lazarus Group. Researchers estimate that North Korea-linked actors have accounted for 89 per cent of all cryptocurrency hack losses in 2026, with total stolen digital assets reaching $7.6 billion this year. Analysts in Seoul noted that Pyongyang's rapid official denial likely stems from concerns over potential tightening of international financial measures aimed at disrupting illicit funding sources for its domestic weapons programs.

Following the temporary suspension and phased restoration of withdrawals starting on Sunday, Binance executives confirmed that market conditions on the platform have stabilized.

Speaking at a Hong Kong Fintech Week panel on Tuesday, Binance Co-CEO Richard Teng confirmed the exchange remains financially secure and that net customer withdrawals reached $4.72 billion before leveling off:

"In the first 24 hours, there was a spike in terms of withdrawals, as can be expected. But after that ... it's pretty much normalised…The company is in very strong financial health…This is something that we can cover. We are able to do so."

The net outflows represent approximately 3 per cent of Binance's total assets under management, which currently stand at roughly $157 billion. To retain users and maintain platform liquidity, Binance launched a "community appreciation campaign" offering fee rebates and high-yield incentives running through November 21st.

A spokesperson for Binance confirmed that the exchange has replaced roughly 95 per cent of the stolen funds using corporate reserves, its Secure Asset Fund for Users (SAFU), and futures insurance funds, with the remaining 5 per cent consisting of less liquid tokens undergoing gradual repurchasing:

"Withdrawal levels are stabilising to what we would consider normal and expected on-chain activity."

While Binance proceeds with phased network restorations, blockchain analytics firms report that the perpetrators are conducting automated, multi-chain laundering procedures to obscure the origins of the stolen funds.

According to data compiled by Elliptic:

• Transaction Scale: In the first four days following the breach, hackers utilized approximately 12,000 unique crypto wallets across 11 distinct blockchains, performing over 40,000 individual transactions at an average rate of one new wallet every 25 seconds.
• Network Transfers: Initial laundering focused on the Tron network, distributing funds across 7,700 addresses before moving at least $147 million onto the Ethereum network via cross-chain bridges. Operations have since expanded to Solana.
• Frozen Assets versus Active Funds: Stablecoin issuers including Tether and Circle froze approximately $786 million in assets before they could be converted. However, roughly $3.24 billion remains in active control of the perpetrators, primarily held in Bitcoin and Ether.
• Mixing Activity: Initial instances of Bitcoin mixing, a process used to obscure transaction histories, were detected, involving 28 Bitcoin worth approximately $2.2 million.

Security analysts expect the remaining un-frozen funds to be gradually converted and moved through over-the-counter brokers over several months as law enforcement agencies attempt to track and block associated wallet addresses.