FBI Blames North Korea for Binance Crypto Heist (North Korea Refutes)
Kanako Mita, Sawako Utsumi, and Lee Jay Walker
Modern Tokyo Times
Last year, North Korea (Democratic People’s Republic of Korea – DPRK) was allegedly involved in the $1.5 billion cryptocurrency theft from Bybit. This highlighted the evolving relationship between cyber warfare, intelligence operations, international sanctions, and state financing. Accordingly, the latest $6.3 billion cryptocurrency heist involving the Binance platform immediately attracted suspicion. Therefore, the FBI’s announcement that North Korea was once again responsible for a major cyberattack was hardly unexpected.
Concerning the Bybit cryptocurrency hack, it is believed that a similar modus operandi is already being employed, whereby multiple blockchains are connected to thousands of cryptocurrency addresses. Consequently, Binance faces a comparable challenge in tracing and recovering the stolen assets.
Following the Bybit attack, the FBI warned that the stolen assets were being rapidly transferred across cryptocurrency networks. It stated: “TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains.”
According to the FBI, the “TraderTraitor actors” – identified as the Lazarus Group – utilized Ethereum to transfer the stolen assets. The next stage involves further dispersing the proceeds through decentralized finance (DeFi) platforms and instant cryptocurrency swap services, making the funds increasingly difficult to trace and recover.
The Independent reports: “North Korea began conducting major cyber-attacks in the 2000s. Early operations primarily targeted South Korea. But its cyber operations gradually expanded beyond the Korean peninsula, with the 2017 WannaCry attack a prominent example of this development.”
Cybersecurity experts maintain that hackers linked to North Korea are among the most prolific perpetrators of cryptocurrency theft and other forms of cybercrime. One major concern is that Pyongyang utilizes these illicit funds to finance its expanding military capabilities, potentially circumventing international sanctions. However, it should also be acknowledged that North Korea’s economy has experienced growth in recent years, partly reflecting increased economic, geopolitical, and infrastructural ties with China and the Russian Federation.
France 24 reports: “The FBI said at the weekend that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, the world’s biggest cryptocurrency exchange, in what could be the largest-ever financial heist.”
The BBC reports: “Blockchain analysts and the FBI have said the attack was led by state-backed hacking group TraderTraitor.”
Kim Yo Jong, the sister of Kim Jong Un, dismissed the FBI’s allegations. According to her, and other officials within North Korea’s inner political circle, the country is being made a scapegoat by hostile forces seeking to undermine its international reputation.
Kim Yo Jong said: “The FBI is trying to brand the DPRK as a ‘cybercriminal state,’ claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident.”
She further dismissed the allegations as absurd and part of an established pattern of political rhetoric, stating that “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cybercrimes in different parts of the world are our deeds.”
In August 2026, Bybit, one of the world’s largest cryptocurrency exchanges, announced that it had filed a civil lawsuit in the United States against the DPRK, its Reconnaissance General Bureau (RGB), and the Lazarus Group. U.S. authorities have identified Lazarus as a DPRK-linked hacking organization allegedly responsible for the February 2025 cyberattack. Bybit also secured a preliminary injunction to freeze identified stolen assets while legal proceedings continue. Therefore, it remains to be seen whether Binance will pursue a similar legal course against North Korea.
Binance, which reported approximately $157 billion in assets, immediately pledged to cover the losses resulting from the cyberattack. Subsequently, the company announced that it had replaced approximately $6 billion of the $6.3 billion in stolen assets, representing around 90 percent of the total. The remaining losses involve less-liquid assets that may take longer to replace.
Kim Yo Jong said: “It is the consistent policy stand of the DPRK government to resolutely oppose all sorts of malicious acts in cyberspace.”
The latest cryptocurrency theft provides further evidence of vulnerabilities within the global financial system and the difficulties of responding to sophisticated cyber operations. More broadly, it highlights how state-linked actors can exploit the decentralized architecture of cryptocurrency networks, while the political and jurisdictional barriers surrounding their alleged activities make investigations and accountability particularly difficult. The intersection of cyber warfare, international sanctions, intelligence operations, and illicit state financing is therefore becoming an increasingly significant challenge to international security.
Modern Tokyo News is part of the Modern Tokyo Times group
http://moderntokyotimes.com Modern Tokyo Times – International News and Japan News
http://sawakoart.com – Sawako Utsumi and Modern Tokyo Times artist
https://moderntokyonews.com Modern Tokyo News – Tokyo News and International News
PLEASE JOIN ON FACEBOOK