North Korea Rejects US Claims It Stole $6 Billion From Binance

North Korea rejected US allegations that it was behind a $6 billion cryptocurrency theft from Binance, with Kim Yo Jong calling the claims absurd rhetoric and a political provocation, as South Korea's spy agency ordered emergency cybersecurity checks following a wave of data breaches at financial firms and government bodies.

North Korea Denies US Allegations Over Binance Crypto Heist

Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, rejected the FBI's claims linking Pyongyang to the theft of more than $6 billion in virtual assets from Binance. [1] She described the assertion as an attempt to brand the DPRK as a "cyber criminal state" and said the US assertion is "absurd rhetoric and nothing new." [1] Kim Yo Jong added that it is a grave political provocation against the DPRK for the US to mislead international public opinion as if all cyber crimes in different parts of the world are the deeds of North Korea. [1] In the wake of the allegations, she said North Korea had "issues to reconsider" over what she called US hostility. [1] Analysts in Seoul said Pyongyang's unusually swift response likely reflected concern that the allegation could lead to tighter efforts to disrupt revenue streams that North Korea is accused of using to finance its weapons. [1] Hong Min, a senior researcher at the Korea Institute for National Unification in Seoul, stated that the key message is not about cyber theft itself but about US-North Korea relations, with Pyongyang essentially saying not to use this issue as leverage or pressure if the door to dialogue is to remain open. [1]

Scale of Alleged North Korean Crypto Thefts

The FBI stated that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance, the world's biggest cryptocurrency exchange, in what could be the largest-ever financial heist. [1] The FBI said members of a North Korean state-sponsored unit known as TraderTraitor were responsible for the Binance attack, and law enforcement had observed them converting the stolen assets to the cryptocurrency ethereum with expectations they would launder the assets further. [1] Binance has said it covered most of the assets stolen from the platform by using company money. [1] Cybersecurity experts and analysts say North Korean hackers are among the world's most prolific crypto thieves, with proceeds helping fund the country's weapons programmes. [1] Blockchain analytics firm Chainalysis estimated 89% of crypto hack losses in 2026 were linked to North Korea, up from 15% in 2021. [1] It said the average reported loss per hack rose from $50.65 million in 2021 to $185.65 million in 2026. [1] Alec Zebrick, senior manager of Asia-Pacific Global Services at Chainalysis, noted that North Korean actors appear to be engaging in big game hunting by targeting larger exchanges that may take more time and complexity but offer relatively large payoffs. [1] Lim Eul-chul, a professor at Kyungnam University's Institute for Far Eastern Studies, said that with sanctions already in place, cryptocurrency theft has become one of North Korea's key channels for securing funds for regime maintenance and weapons development. [1] South Korea's central bank estimated North Korea's gross domestic product at 47.18 trillion won ($35.09 billion) in 2025, meaning the Binance theft could be equivalent to about a sixth of its economic output. [1] North Korea denies allegations linking it to cryptocurrency theft and other cybercrimes. [1]

South Korea Orders Emergency Cybersecurity Reviews

South Korea's National Intelligence Service asked 2,100 public institutions to conduct emergency cybersecurity inspections following a series of cyberattacks on financial firms that resulted in customer data breaches. [2] The NIS called on central government agencies and local governments to carry out their own security checks based on a checklist. [2] Separately, the NIS plans to conduct its own vulnerability assessments of critical information and communications infrastructure in the public sector, with the assessments expected to be completed by mid-November. [2] The NIS has called for particular attention to be paid to the management of potential cyberattack entry points, the operation of security monitoring systems and the application of security patches. [2] Local financial institutions, including banks, savings banks and insurance companies, were hit by a series of cyberattacks last month, exposing about 100,000 cases of personal information across the industry, including email addresses, names and phone numbers. [2] The Ministry of Science and ICT raised the country's cyber crisis warning level by one notch to "caution," the second lowest in its four-tier system. [3]

Growing Cyber Risks to South Korean Economy

The scale and frequency of the breaches have raised concerns that cyber threats could extend beyond personal data theft to disrupt financial services, business operations and industrial supply chains. [3] On Oct. 14, the Financial Services Commission said cybersecurity incidents had been confirmed at 16 financial firms, affecting approximately 100,000 customer records, with the affected institutions including commercial banks, savings banks and credit finance companies. [3] On Oct. 28, Daishin Securities, Mirae Asset Global Investments and cryptocurrency exchange Bithumb reported separate cybersecurity incidents involving customer information. [3] Police have launched a preliminary investigation into the online leak of personal information belonging to 168 individuals who traveled aboard the presidential aircraft during a trip to Europe in June, including President Lee Jae Myung, the first lady and Cabinet ministers. [3] The foreign ministry said it is taking steps to reissue the passports of the president and first lady. [3] The threat is growing as hackers increasingly turn to artificial intelligence tools to find security weaknesses and launch attacks against multiple targets. [3] Kim Jin-soo, chairman of the Korea Information Security Industry Association, said the top priority is to strengthen the fundamentals of cybersecurity by properly establishing basic defenses, including firewalls, encryption, multifactor authentication, and vulnerability detection and response systems, and that both businesses and the government must significantly increase their cybersecurity investments from current levels. [3]

What to watch next: The NIS will complete its vulnerability assessments of critical public infrastructure by mid-November while financial regulators plan to tighten identity checks, access controls and information sharing.