North Korea has denied involvement in the theft of approximately $6.3 billion from cryptocurrency exchange Binance, describing allegations by the United States as a political provocation.
Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, made the denial in a statement published by the country’s state-run media on Tuesday, November 3, 2026.
She accused Washington of repeatedly linking North Korea to major international cybercrime incidents without sufficient evidence, describing the allegations as attempts to damage the country’s international reputation.
Her reaction followed an announcement by the United States Federal Bureau of Investigation (FBI), which attributed the October 29 cryptocurrency theft to TraderTraitor, a hacking group linked to North Korea.
The FBI also identified cryptocurrency wallet addresses associated with the stolen funds and urged cryptocurrency exchanges and other digital asset platforms to block transactions involving them.
According to blockchain analytics firm TRM Labs, approximately $6.36 billion was transferred from Binance wallets across 10 different blockchains during the attack, which reportedly unfolded within about 20 minutes.
The incident has been described as one of the largest cryptocurrency thefts on record, surpassing the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025.
The cryptocurrency exchange, Binance, has reportedly set aside more than $6.34 billion from its own reserves to cover the losses and is working with industry partners to recover the stolen assets.
Reports also indicate that approximately $3 billion worth of the affected assets have been frozen following efforts by cryptocurrency platforms and security investigators.
Although North Korea has repeatedly denied involvement in major cyberattacks, security experts say cryptocurrency theft has become an important source of foreign currency for the heavily sanctioned country.
The latest denial comes as investigations into the Binance incident continue, with the US authorities maintaining their attribution of the attack to North Korean-linked hackers.
