Eager to Rebut Rogue-Nation Image, North Korea Denies Role in Binance Heist — WSJ
By Dasl YoonNorth Korea has denied it was behind the record-breaking $6.3 billion hack of cryptocurrency exchange Binance, in a move analysts say is designed to push back against Western depictions of the regime as a rogue state.The Federal Bureau of Investigation said in recent days that the regime of North Korean leader Kim Jong Un was responsible for last week's enormous theft. On Tuesday Kim Yo Jong, Kim Jong Un's powerful sister, fired back, calling such a claim "absurd rhetoric."In a statement, Kim Yo Jong said the U.S. was spreading misinformation by pinning the blame on North Korea for both the Binance heist and last year's Bybit hack of $1.5 billion."It's a grave political provocation," she said. "The U.S. misleads the international public opinion as if all the cybercrimes in different parts of the world are our deeds."The swift rebuttal by a figure as powerful as Kim's sister is unusual. The regime rarely responds to accusations of involvement in cybercrime. When it does, such a statement is typically handled by working-level officials, said Hong Min, a senior researcher at the Korea Institute for National Unification, a South Korea-funded think tank."She doesn't want the U.S. to reinforce North Korea's image as an illicit actor," he said.North Korea has deepened ties with Russia and China in recent years and strives to be recognized as a formidable nuclear power rather than a rogue nation.The Binance hack, alleged to have been carried out by North Korean cybercrime unit "TraderTraitor," was the largest such heist in history.Binance said on Tuesday that attackers pulled off the heist by planting malware onto the devices of multiple employees.One employee was contacted for a job interview in September via a "legitimate job-hunting platform," Binance said in a statement posted to X. During a second-round interview with the fictitious company, the employee was instructed to download an "assignment" onto his work computer that contained malicious code.North Korea has historically relied on "social engineering" techniques as a key part of its cyber arsenal — tricking employees into downloading malware rather than hacking into companies outright.Pyongyang is responsible for 89% of crypto hacking losses this year, a sharp rise from 15% in 2021, according to analytics firm Chainalysis. Kim's regime uses the proceeds from such theft to fund its weapons programs, according to analysts and Western officials.Stablecoin providers and others quickly froze about $2.8 billion of the stolen assets, but Pyongyang has already begun laundering the funds by routing them through different blockchain networks, according to analytics firms. The laundering patterns, with thousands of transactions happening in a short period, suggest the attackers may be using automation to obscure the funds' origins, according to Chainalysis.In the case of the 2025 Bybit hack, it took North Korea 10 days to swap stolen assets into bitcoin, and then several months to cash it out through suspected Chinese over-the-counter trading services, according to analytics firm Elliptic. They are also expected to swap the Binance funds for bitcoin in many small transactions and cash them out through brokers over months. That means the funds would likely be available for the government around next year.Moving the stolen cryptocurrency quickly can result in price fluctuations and high transaction fees, leading to losses of millions of dollars. Brokers will also charge high fees to launder the illicit money. More than half of the funds stolen during the Binance hack can't be frozen, giving North Korea's cybercriminals time to launder them.Once funneled into North Korea's coffers, the funds will bankroll the Kim regime's military modernization drive. Pyongyang has been testing newer weapons systems including cluster bombs, a multiple-rocket launcher designed to carry nuclear warheads and a cruise missile mounted with a warhead that disperses submunitions over a wide area.On Monday, Pyongyang test fired smaller cluster warheads on cruise missiles to strike a target on an island, according to state media.North Korea's crypto hacking provides about half of its foreign currency earnings and funds roughly half of its missile program, Western officials have said.In her Tuesday statement, Kim Yo Jong acknowledged that the hack was "extra-large" but maintained that the U.S. was spreading misinformation. The FBI's accusation is a "sinister attempt to damage the international image" of North Korea, she said.Write to Dasl Yoon at [email protected]