Kim Yo-jong Denies North Korea Role in Binance's $6.3 Billion Hack

Kim Yo-jong's Second Denial

Kim Yo-jong, the sister of North Korean leader Kim Jong Un and a senior Workers' Party official, issued a second statement on November 4 rejecting US accusations that Pyongyang carried out the theft of roughly $6.3 billion in crypto assets from Binance. The statement, released through North Korean state media KCNA, followed her first response on November 2 and framed the Federal Bureau of Investigation's attribution of the breach as an extension of Washington's long-standing hostile policy rather than an isolated security incident. In her earlier statement she had called the FBI's findings a “serious political provocation” and accused the United States of using cryptocurrency crime allegations to damage North Korea's image abroad. In the new message she said Washington was attempting to extract political and strategic benefit from the incident and that the approach was producing a political backlash.

In the November 4 message she described the so-called North Korean crypto hacking case as the tip of the iceberg of US hostility, grouping it with the recent meeting of the South Korean, US and Japanese foreign ministers, which reaffirmed commitments to North Korea's complete denuclearization, and with repeated joint military exercises that she said make Washington's “hostile signals” impossible to ignore. On dialogue she said the choice of peace does include talks, but dialogue does not necessarily serve North Korea's national interest, and that Washington's abandonment of its hostile policy is the major premise and the key to resolving all problems. “We have no need to sit face to face with such untrustworthy, hostile people,” she said, warning that if US hostility keeps setting new records, North Korea's countermeasures should set new records too. She stopped short of permanently closing dialogue channels.

FBI Attribution and Binance's Post-Mortem

The denials stand against a detailed law-enforcement and corporate record. On October 31 the FBI formally attributed the October 29 theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-linked cyber campaign. The bureau said the attackers are converting part of the stolen funds into Ethereum (ETH) and may move them further through decentralized finance services and instant exchange platforms. It also published multiple on-chain wallet addresses tied to the laundering and asked crypto businesses to help block the suspicious flows, an appeal that puts the burden of freezing the money on exchanges and DeFi operators rather than on any single investigator.

Binance's own preliminary report, published on November 3, traced the intrusion back to June and described how the attackers used compromised developer tools, fake recruitment interviews and a misused internal AI tool to work their way into the exchange's wallet development team, ultimately obtaining unauthorized access to the transaction signing service that authorizes movements of funds from its institutional crypto wallet infrastructure. President Trump had said on October 31, when asked about the hack, that the United States would discuss the matter with North Korea if Pyongyang's involvement was confirmed, an offer Kim's team has now effectively answered with preconditions rather than a flat refusal.

COINOTAG's reading: Kim's statements are political messaging and carry no independently verifiable technical rebuttal, so the FBI attribution and Binance's post-mortem remain the operative account of what happened. The load-bearing question is on-chain: the laundering pattern in the FBI notice, conversion into ETH and movement through DeFi and instant swaps, depends on trading volume that no single service can fully police, and the published addresses will show whether funds move faster than the industry can freeze them. Politically the incident has hardened into a precondition dispute: Trump signaled willingness to negotiate while Pyongyang now prices any talks at the end of hostile policy, leaving both the $6.3 billion recovery and the diplomatic track in limbo.