Key Highlights:
- North Korea has officially denied responsibility for major cryptocurrency breaches, including allegations involving Binance and the $1.5 billion Bybit hack.
- Kim characterized Washington’s accusations as political provocation and suggested without evidence that the United States could be behind the incident.
- Independent blockchain intelligence firms, including TRM Labs, Chainalysis, and ZachXBT, have linked the cyberattacks to state-backed North Korean hacking outfits like TraderTraitor.
North Korea Dismisses Allegations of Crypto Cybercrime
North Korea has forcefully pushed back against allegations linking the country to high-profile cryptocurrency thefts, calling the accusations a political provocation designed to tarnish its international standing. In a recent statement, Kim dismissed claims made by the Federal Bureau of Investigation (FBI), which blamed North Korea for major security breaches, including the massive $1.5 billion Bybit hack in February 2025.
“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” said Kim. The official asserted that North Korea firmly opposes malicious activity across cyberspace and accused the United States of weaponizing and politicizing cybersecurity issues to intervene in the internal affairs of other sovereign nations.
Kim Accuses the United States Over the Binance Exploit
Beyond rejecting direct involvement, Kim deflected suspicion toward the United States, suggesting Washington was connected to the Binance exploit without providing any corroborating evidence. According to Kim, financial flows following potential asset recoveries would reveal the true beneficiaries.
“If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident,” she said.
U.S. Midterm Elections Pose Risk for Solana as 5% SOL ETF Outflows Threaten Further Losses
Despite the assertion, Kim offered no technical or verifiable proof tying U.S. agencies or entities to the security incident. Requests for comment sent by Cointelegraph to the FBI regarding the statement have remained unaddressed.
Blockchain Investigators Trace Attacks to TraderTraitor Group
Kim’s statements directly contradict findings compiled by several premier onchain analytics firms. Blockchain intelligence company TRM Labs evaluated the attack on Binance with high confidence, attributing the breach directly to the Democratic People’s Republic of Korea (DPRK) cyber syndicate known as TraderTraitor based on a combination of onchain data and offchain intelligence. Analytics firm Chainalysis and independent onchain researcher ZachXBT similarly traced the digital heist back to North Korean operatives.
According to TRM Labs, the tactics used in the Binance intrusion mirrored methods documented in prior North Korean operations. These hallmarks included extensive advance operational planning, funding threat-actor wallets via privacy protocol Tornado Cash, and the coordinated execution of compromised transaction signatures collected prior to the exploit. The firm noted, however, that the money laundering patterns deployed in this instance diverged somewhat from the playbook seen after the Bybit incident.
Further cross-protocol analysis by ZachXBT highlighted direct links across multiple platform compromises. ZachXBT discovered that proceeds from both the Binance breach and the Bitget hack were commingled at an identical recipient address after moving through the decentralized liquidity network THORChain. These tracking efforts align with earlier findings shared by Bitget CEO Gracy Chen, who stated during the initial investigation that preliminary discoveries linked attack IP addresses to VPN networks frequently utilized “by a certain DPRK group.”
Why This Matters
The friction between geopolitical denials and decentralized forensic data underscores the escalating friction between sovereign cyber operations and international digital asset security. North Korea has repeatedly faced international scrutiny and law enforcement sanctions over allegations of leveraging advanced cyber outfits to fund state operations through crypto exploits. With institutional firms, independent sleuths, and national law enforcement collaborating to map multi-chain laundering pathways across THORChain and mixing services, the conflict highlights the growing reliance on transparent public ledgers to identify and counter sophisticated state-sponsored cyber warfare.
Frequently Asked Questions
What is North Korea’s official response to the crypto hack accusations?
North Korean official Kim categorically rejected allegations connecting the DPRK to major exploits like the Binance and Bybit hacks, calling them baseless provocations and claiming that the United States utilizes cyber allegations for political interference.
What evidence did Kim provide linking the U.S. to the Binance hack?
Kim provided no concrete evidence to substantiate the claim, merely stating that investigators should look into which entities receive the stolen cryptocurrency once the funds are retrieved.
Which firms have attributed the hacks to North Korean groups?
Prominent blockchain analytics firms including TRM Labs, Chainalysis, and independent onchain sleuth ZachXBT have attributed the attacks to North Korean hackers such as TraderTraitor, citing operational signatures, Tornado Cash funding, and shared THORChain laundering addresses.
