Kim Yo Jong, the sister of North Korean leader Kim Jong Un, has denied Pyongyang's involvement in the $6.3 billion Binance hack and appeared to suggest, without evidence, that the United States could have been behind the theft.

In a statement released through the Korean Central News Agency (KCNA) on Tuesday, Kim rejected the FBI's attribution of the attack to a North Korean-backed hacking group.

“The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident,” Kim said. “But the US assertion is an absurd rhetoric and nothing new.”

She described the allegations as a political provocation intended to damage North Korea's international standing. The FBI also blamed North Korea for the $1.5 billion Bybit hack in February 2025 — an accusation Kim likewise rejected on Tuesday. The stakes of the dispute are sizable for the industry: at roughly four times the size of the Bybit loss, the Binance theft was described in earlier coverage as a record for crypto.

“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” she said.

Kim casts suspicion on Washington

Kim went further, directing suspicion at the United States over the Binance incident.

“If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident,” she said.

Her statement offered no evidence connecting Washington to the attack. Cointelegraph reached out to the FBI for comment, and any public response from US authorities will be one marker of how the dispute develops.

Investigators cite links to earlier North Korean hacks

Last week, blockchain intelligence firm TRM Labs attributed the Binance attack to North Korea's TraderTraitor group with high confidence, citing onchain and offchain intelligence. Other investigators, including Chainalysis and ZachXBT, also linked the theft to North Korean hackers.

TRM Labs cited similarities with previous North Korean attacks, including advance preparation, the use of Tornado Cash — a crypto mixer that obscures the origin of funds — to fund attacker wallets, and the coordinated execution of previously obtained transaction signatures. It noted, however, that the laundering activity differed from the pattern seen after the Bybit hack.

Onchain investigator ZachXBT separately identified a connection between the Binance and Bitget hacks, saying stolen funds from both incidents were commingled at the same address after passing through THORChain, a cross-chain protocol used to move funds between blockchains. During the early stages of the investigation, Bitget CEO Gracy Chen said preliminary findings linked IP addresses to VPN services used “by a certain DPRK group.”

For exchanges and their users, the combined findings underline how stolen assets can be routed through multiple protocols and commingled along the way — the kind of onchain trail investigators follow as they work to trace the funds. Developments worth watching include whether the FBI publicly responds to Kim's statement and where the commingled funds surface next as the tracing effort continues.

Related coverage: North Korea linked to $6.3B Binance hack by crypto investigators and FBI blames North Korea for record $6.3B Binance hack.