Kim Yo‑jong rejects FBI hack claim

What's happened

North Korea's Kim Yo‑jong has denied FBI claims that a state‑linked hacking unit — identified as TraderTraitor/Lazarus — stole about $6.3bn from Binance, calling the allegation "absurd rhetoric" and a "grave political provocation." U.S. agencies and blockchain firms have traced large movements of the stolen crypto and urged industry action while Binance has partially restored withdrawals.

What's behind the headline?

What happened

• The FBI has attributed the late‑October theft of roughly $6.3 billion from Binance to a North Korea‑linked hacking unit known as TraderTraitor (also called Lazarus).
• Kim Yo‑jong has issued an official denial, calling the FBI statement "absurd rhetoric" and accusing Washington of trying to brand the DPRK a "cyber criminal state."

Why this matters

• North Korea has been using advanced laundering techniques across multiple blockchains; firms such as Elliptic and Chainalysis have documented automated conversion and layering across Tron, Ethereum, Solana and cross‑chain bridges.
• The theft has already forced exchanges, issuers and blockchain analysts to harden defences and to freeze or reclaim billions in assets. That operational pressure will increase industry cooperation on real‑time blocking and sanctions compliance.

Who benefits and who loses

• Binance has absorbed most customer losses and is restoring withdrawals, which will protect its market position in the near term. Exchanges that enforce swift freezes will reduce loss but face increased compliance costs.
• North Korea, if confirmed, would continue to gain a substantial revenue stream to evade sanctions; if not confirmed, Pyongyang's denials will complicate diplomatic and enforcement responses.

Likely next steps

• Law enforcement and analytics firms will continue tracing conversions into bitcoin and other cashable assets; laundering will shift more slowly to mixing services and over‑the‑counter brokers, spreading the cash‑out timeline across months.
• Regulators will push for faster information‑sharing between exchanges and custodians and for stronger controls on cross‑chain bridges and decentralised exchanges.

Bottom line

The dispute over attribution will keep diplomatic tensions high while technical tracing and asset freezes will define the operational response. The stolen funds will likely be converted gradually and targeted enforcement will determine how much cash actually exits the crypto system.

How we got here

The FBI has attributed the late‑October Binance breach to a North Korea‑linked group called TraderTraitor. Blockchain firms have traced billions moved through thousands of wallets; law enforcement and exchanges have frozen or reclaimed large portions of the sum while investigations continue.

Our analysis

Several outlets have reported the denial and the technical tracing but emphasised different details. Business Insider published Kim Yo‑jong's full rebuke via KCNA, quoting her: "The FBI is trying to brand the DPRK as a 'cyber criminal state'..." (Business Insider UK, Nov. 3). The BBC carried a similar KCNA statement and noted that the FBI, the Secret Service and cyber analysts have said North Korea orchestrated the hack and called it "the largest in history" (BBC Business, Nov. 3). AP News provided broader context on North Korea's past cyber activities and quoted Kim Yo‑jong calling the FBI announcement "a trite provocation" and "an absurd rhetoric" while outlining Seoul's concern about illicit cyber activity (AP News, Nov. 2). On technical tracing, CNBC cited Elliptic and Chainalysis reporting large, highly automated laundering operations: roughly 12,000 wallets across 11 blockchains, 40,000 transactions and heavy initial use of Tron and cross‑chain bridges, with about $786m in stablecoins converted before issuers froze assets (CNBC, Nov. 3). CNBC also reported Elliptic's estimate that about $2.85bn has been frozen or seized and roughly $3.24bn remains in addresses tied to the theft. These accounts together show a clear split: state media statements quoted by Business Insider, BBC and AP give Pyongyang's categorical denial; blockchain firms and US agencies presented detailed forensic tracing and urged industry blocking measures (CNBC, Elliptic, Chainalysis). Readers who want primary reporting should read the KCNA‑quoted denial in Business Insider and the technical reports summarised by CNBC and Elliptic.

Go deeper

• How do blockchain firms trace stolen crypto across chains?
• What tools can exchanges use to block or freeze laundered funds?

More on these topics

• North Korea - Country in East Asia

  North Korea, officially the Democratic People's Republic of Korea, is a country in East Asia constituting the northern part of the Korean Peninsula.

• Binance - Cryptocurrency exchange company

  Binance is a cryptocurrency exchange that provides a platform for trading various cryptocurrencies founded in 2017. As of April 2021, Binance was the largest cryptocurrency exchange in the world in terms of trading volume.

• The United States of America - Country in North America

  The United States of America, commonly known as the United States or America, is a country mostly located in central North America, between Canada and Mexico.

• Bybit - Bank

  Bybit Fintech Limited, known as Bybit, is a Dubai based centralized cryptocurrency exchange. The platform has faced regulatory warnings in several jurisdictions. In February 2025, the exchange was hacked resulting in the loss of $1.5 billion in assets...

• Donald John Trump - 45th and 47th U.S. President

  Donald John Trump is an American politician, media personality, and businessman who is the 47th president of the United States. A member of the Republican Party, he served as the 45th president from 2017 to 2021.

• Sony Pictures - Entertainment company

  Sony Pictures Entertainment Inc. is an American entertainment company that produces, acquires, and distributes filmed entertainment through multiple platforms.

• Korean Central News Agency

  The Korean Central News Agency is the state news agency of North Korea. The agency portrays the views of the North Korean government for both domestic and foreign consumption. It was established on December 5, 1946 and now features internet coverage.

• Federal Bureau of Investigation - Law enforcement agency

  The Federal Bureau of Investigation is the domestic intelligence and security service of the United States and its principal federal law enforcement agency.

• Lazarus Group

  Lazarus Group is a cybercrime group made up of an unknown number of individuals. While not much is known about the Lazarus Group, researchers have attributed many cyberattacks to them over the last decade.

• Kim Yo-jong - North Korean Politician

  Kim Yo-jong is a North Korean politician serving as the first vice director of the United Front Department of the Workers' Party of Korea.

• Chainalysis - Company

  Chainalysis is an American blockchain analysis firm headquartered in New York City. The company was co-founded by Michael Gronager, Jan Møller and Jonathan Levin in 2014, and is the first start-up company dedicated to the business of Bitcoin tracing.

• Ethereum - Public blockchain platform with programmable transaction functionality

  Ethereum is a decentralized blockchain with smart contract functionality. Ether (abbreviation: ETH) is the native cryptocurrency of the platform. Among cryptocurrencies, ether is second only to bitcoin in market capitalization. It is open-source software. Ethereum was conceived in 2013 by programmer Vitalik Buterin. Other founders include Gavin Wood, Charles Hoskinson, Anthony Di Iorio, and Joseph Lubin. In 2014, development work began and was crowdfunded, and the network went live on 30 July 2015. Ethereum allows anyone to deploy decentralized applications onto it, which anyone can then use. Decentralized finance (DeFi) applications provide financial instruments that do not directly rely on financial intermediaries like brokerages, exchanges, or banks. This facilitates borrowing against cryptocurrency holdings or lending them out for interest. Ethereum allows users to create fungible (e.g. ERC-20) and non-fungible tokens (NFTs) with a variety of properties, and to create smart contracts that can receive, hold and send those assets in accordance with the contract's immutable code and a transaction's input data. On 15 September 2022, Ethereum transitioned its consensus mechanism from...

• Bitcoin - Currency

  Bitcoin is a cryptocurrency invented in 2008 by an unknown person or group of people using the name Satoshi Nakamoto and started in 2009 when its implementation was released as open-source software.