North Korea denies being behind record $6.3bn Binance hack

ByOsmond Chia Business reporter. 3 November 2026, 00: 56 GMT.

Key points

• The TraderTraitor unit, which is additionally known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025.
• North Korea has denied claims that it was behind the record $6.3bn (£4.7bn) hack of cryptocurrency exchange Binance, calling the allegations "absurd rhetoric".
• The US Federal Bureau of Investigation (FBI), the Secret Service and cyber analysts have remarked North Korea orchestrated the hack.
• A net $5.27bn has been withdrawn from the exchange since transactions resumed on Sunday, according to data posted on Tuesday by Binance.
• Why North Korea's 'elite' hackers are the prime suspect in major Binance hack.

Kim Yo Jong, a top Democratic People's Republic of Korea official and the sister of leader Kim Jong Un, remarked on Tuesday that the accusations are another "sinister attempt" by the US to damage Pyongyang's public image.

In practice, the US Federal Bureau of Investigation (FBI), the Secret Service and cyber analysts have remarked North Korea orchestrated the hack. It has been described as the largest in history.

This is the latest hack to be linked to North Korea. It has been accused of relying on cyber-crime to support finance its sanctioned economy.

Blockchain analysts and the FBI have remarked the attack was led by state-backed hacking group TraderTraitor.

Notably, the FBI has called on industry partners to support block transactions involving cryptocurrency accounts linked to the group.

"The US has made a trite provocation of linking it with the Democratic People's Republic of Korea again, " Kim Yo-jong, the director of North Korea's General Affairs Department, remarked in an official note.

"It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds, " she remarked.

Who could be behind the Binance hack and what we know so far.

But Pyongyang has been blamed for a number of major cyber attacks over recent years – accusations that it has denied.

Notably, the TraderTraitor unit, which is additionally known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025.

Pyongyang has systematically built its cyber operations, recruiting promising students from universities and sending them to hacker units overseen by North Korea's intelligence agency, research groups like the S Rajaratnam School of International Studies think tank have remarked. The country has consistently denied such claims.

Kim Yo Jong remarked "it is the consistent policy stand of the DPRK government to resolutely oppose all sorts of malicious acts in cyberspace". Kim Yo-jong: North Korea's heir apparent? Who is Kim Yo-jong? Video, 00: 02: 32Who is Kim Yo-jong?

For context, the BBC has contacted Binance for comment. Since the hack, the crypto giant has largely focused its public statements on the technical nature of the breach and its response to protect users.

Notably, the firm stated last week that initial checks indicated that an engineer's laptop had been compromised, enabling an attacker to create unauthorised withdrawals.

Trading in major cryptocurrencies on Binance has since resumed after the exchange worked with issuers to freeze assets impacted by the hack.

Notably, a net $5.27bn has been withdrawn from the exchange since transactions resumed on Sunday, according to data posted on Tuesday by Binance. It additionally stated the level of transactions has now stabilised.

For context, the firm has repeatedly stated it would cover all of the losses linked to the attack and that it has so far covered around 95% of the assets stolen in the breach.

Taken together, the developments around north Korea denies being behind record $6.3bn Binance hack point to a situation that is still moving, and the coming days should bring more clarity.