North Korean Leader’s Sister Denies Involvement in $6.4B Binance Hack

TL;DR:

• Disputed amount: The attack drained an estimated $6.4 billion in digital assets across multiple blockchains.
• Official attribution: The FBI formally identified the North Korean state-sponsored group TraderTraitor as the technical executor of the breach.
• Pyongyang’s stance: Kim Yo Jong stated through the state news agency KCNA that the U.S. accusation constitutes a political provocation lacking conclusive evidence.

Kim Yo Jong, sister of North Korean leader Kim Jong Un and a senior official of the Workers’ Party, categorically rejected that her country had any connection to the recent Binance hack.

The statement was released this Tuesday by the state news agency KCNA. In the release, the North Korean official described the Federal Bureau of Investigation (FBI) allegations as “absurd rhetoric” aimed at tarnishing Pyongyang’s international reputation.

The response comes after the FBI report presented over the weekend. In that document, U.S. federal authorities attributed the theft of virtual assets to the cyber collective TraderTraitor, a division linked to the Lazarus Group cybercrime network.

Data from blockchain analytics firm Chainalysis estimates that the attack drained approximately $6.4 billion through thousands of parallel transfers. According to the Chainalysis report, the attackers attempted to bypass asset freezes by converting part of the stolen stablecoins into Ether tokens.

Binance confirmed that the initial security incident was linked to the compromise of a laptop assigned to a DevOps engineer. That intrusion allowed the attackers to access service containers to issue unauthorized withdrawal requests across ten different blockchains.

For its part, Binance leadership reported that the private keys of its cold wallets were not compromised. The exchange’s administration specified having frozen nearly $3.0 billion in funds linked to the attack thanks to immediate collaboration with issuers such as Tether and Circle.

Cybersecurity Attributions and Diplomatic Tensions

The FBI’s accusation against TraderTraitor adds another case to the registry of incidents attributed to North Korean actors. Intelligence reports from the firm TRM Labs recall that this same group was implicated in the intrusion into the Bybit exchange in February 2025, where roughly $1.5 billion was stolen.

Additionally, statistics published by Chainalysis revealed that groups linked to Pyongyang accumulated the theft of $2.02 billion in crypto assets throughout 2025. With that figure, the historical total of stolen funds attributed to these factions rose to $6.75 billion at the close of the previous fiscal year.

Kim Yo Jong stated that Washington systematically attempts to blame Pyongyang for any international cybercrime in order to justify restrictive measures. The official warned that her government is closely monitoring U.S. actions regarding this hostile posture.

Statements by U.S. President Donald Trump, issued this Tuesday, noted that federal investigators are still analyzing the technical specifics of the case. The president indicated that relevant agencies continue to examine direct connections before issuing a conclusive verdict.

The Federal Bureau of Investigation issued a list containing 628 wallet addresses under scrutiny, urging operators and decentralized finance platforms to permanently freeze any related transactions.