North Korea denies role in $6.3B Binance hack, points finger at US

The Binance hack involved the theft of cryptocurrency valued at $6.3 billion. It matters because investigators connected the incident to a group allegedly supported by North Korea, turning a cybercrime case into an international political dispute. North Korea's Kim Yo Jong rejected the FBI's attribution and called it politically motivated.

TRM Labs linked the attack with high confidence to North Korea's TraderTraitor group. It cited blockchain and other intelligence, plus similarities to earlier North Korean attacks. Those similarities included advance preparation, Tornado Cash activity involving attacker wallets, and coordinated use of previously obtained transaction signatures.

Chainalysis and ZachXBT also linked the theft to North Korean hackers. ZachXBT found that stolen funds from the Binance and Bitget hacks were commingled at one address after passing through THORChain. North Korea denied the accusation, while the FBI's response was still being sought.

Binance is a cryptocurrency exchange, meaning a platform where users can trade and hold digital assets. The article does not explain Binance's services in detail, but it identifies the incident as a $6.3 billion hack. That scale makes the event important for anyone who relies on exchanges to access cryptocurrency.

An attack on a major exchange matters because exchanges concentrate large amounts of digital value and connect users with blockchain networks. If attackers obtain control of transaction systems, signatures, or wallets, they may move assets quickly. The article says investigators found coordinated use of previously obtained transaction signatures during this attack.

The incident also affects trust. Investigators linked it to North Korea, while Pyongyang rejected the claim. The dispute means the hack is not only a security story. It is also a test of how exchanges, intelligence firms, governments, and users assess evidence and protect digital assets.

The Binance hack was valued at $6.3 billion, while the Bybit hack was valued at $1.5 billion. Subtracting the figures gives a difference of $4.8 billion. Dividing $6.3 billion by $1.5 billion shows that the Binance figure is 4.2 times larger.

Both incidents are linked in the article to accusations involving North Korean hackers. The FBI blamed North Korea for the Bybit hack in February 2025, and it also attributed the Binance attack to a North Korean-backed group. Kim Yo Jong rejected both accusations in her statement. This gives the comparison a political dimension as well as a financial one.

The figures describe the reported scale of the thefts, not a confirmed recovery or final loss. The article says investigators examined how funds moved after the Binance attack. It also notes that laundering activity differed from the pattern seen after Bybit, despite similarities in preparation and suspected North Korean links.

TRM Labs attributed the Binance attack to North Korea's TraderTraitor group with high confidence. Its case combined onchain evidence, which concerns blockchain activity, with offchain intelligence. Chainalysis and ZachXBT independently linked the theft to North Korean hackers, adding weight to the attribution while not proving North Korea's official involvement.

TRM Labs identified patterns resembling earlier North Korean attacks. These included advance preparation, use of Tornado Cash to fund attacker wallets, and coordinated execution of transaction signatures obtained earlier. ZachXBT also found a connection between the Binance and Bitget hacks. Funds stolen in both incidents were commingled at the same address after passing through THORChain.

The evidence remains contested. North Korea denied the allegations, and Kim Yo Jong called them political provocation. Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used by a certain DPRK group. TRM Labs also noted that laundering after Binance differed from the Bybit pattern.

Publicly attributing a major hack to a government-backed group changes how the incident is understood. It can affect confidence in exchanges, increase pressure for stronger security, and prompt governments to examine financial flows more closely. The article does not report specific market losses or official retaliation, so those outcomes should not be treated as confirmed.

The Binance case shows how attribution can expand beyond technical analysis. TRM Labs, Chainalysis, and ZachXBT linked the theft to North Korean hackers. The FBI also blamed North Korea for the Bybit hack. Kim Yo Jong rejected both claims and accused the United States of politicizing cybersecurity and damaging North Korea's international standing.

The dispute may make future investigations more contentious. Investigators will need to explain how blockchain trails, wallet behavior, and other intelligence support their conclusions. Exchanges may face greater scrutiny over transaction security and laundering routes. International relations can also be affected when cybercrime accusations involve governments and are publicly contested.

Hackers often try to break the visible trail between a theft and the wallets that ultimately hold the money. Tornado Cash can obscure links between cryptocurrency deposits and withdrawals, while VPNs can hide or alter the apparent location of an internet connection. The article discusses these tools as investigative clues, not proof by themselves.

TRM Labs said earlier North Korean attacks used Tornado Cash to fund attacker wallets. ZachXBT found stolen funds from the Binance and Bitget incidents were commingled at one address after passing through THORChain. THORChain enables movement between blockchain networks, so cross-chain transfers can add complexity to tracing.

These methods do not necessarily erase transaction records. They can create more wallets, routes, and timing patterns for investigators to examine. The article says Binance laundering differed from the Bybit pattern. That difference shows why investigators compare movement patterns instead of relying on one tool or one transaction.

A blockchain transaction is a recorded movement of digital assets between addresses on a blockchain network. An onchain investigation studies those records. Because transactions can be followed across addresses, investigators can map how funds moved after a theft. The article contrasts this blockchain evidence with offchain intelligence, which comes from information outside the ledger.

For example, ZachXBT identified stolen Binance and Bitget funds being commingled at the same address after passing through THORChain. TRM Labs examined advance preparation, Tornado Cash activity, and coordinated use of previously obtained transaction signatures. These clues can reveal shared infrastructure, repeated behavior, or links between separate attacks.

Onchain tracing can show movement, but it does not automatically identify the person or government controlling every address. Investigators therefore combine transaction patterns with other intelligence. In this case, TRM Labs used onchain and offchain information, while Bitget cited preliminary IP and VPN findings. North Korea still denied the resulting attribution.