North Korea has denied responsibility for the $6.3 billion cryptocurrency heist that targeted the Binance exchange, labeling U.S. government accusations as "absurd rhetoric" and a "sinister attempt" to tarnish its image. The Federal Bureau of Investigation (FBI), along with other U.S. agencies, attributed the massive theft to North Korea, identifying the perpetrators as the "TraderTraitor" hacking group. This group is also known by other names, including Lazarus Group, Jade Sleet, and APT38.
The FBI stated that TraderTraitor actors were observed converting the stolen assets primarily into Ethereum (ETH). These assets are expected to be further laundered through decentralized finance (DeFi) platforms and instant swap services. The agency has released a list of wallet addresses associated with the illicit activity, urging private sector entities to block transactions linked to them.
The scale of the Binance hack, which occurred on or about October 29, 2026, makes it the largest cryptocurrency theft in history, surpassing the previous record of $1.5 billion stolen from Bybit in February 2025. Blockchain analysis firms TRM Labs and Chainalysis were among the first to link the heist to North Korea, citing on-chain and off-chain intelligence. These firms indicated that the operation involved sophisticated methods, possibly compromising Binance's transaction-authorization infrastructure.
Binance initially suspended all trading following the incident. The exchange stated that its preliminary investigation suggested a compromised laptop belonging to an engineer may have provided the initial access, enabling unauthorized withdrawals. However, Binance later indicated that the breach involved additional points of access beyond a single compromised laptop. The company has committed to covering all customer losses, utilizing its corporate treasury, futures insurance, and emergency reserve funds. Binance has since resumed phased withdrawals, processing billions of dollars in assets.
North Korea has consistently denied involvement in cyber heists, despite international accusations. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, issued a statement calling the U.S. allegations a "grave political provocation" and "trite provocation." The country's government maintains a policy of opposing all malicious acts in cyberspace. Experts suggest that North Korea increasingly relies on cryptocurrency theft and other illicit cyber activities to generate foreign currency amidst international sanctions.