North Korea has denied allegations it orchestrated a cyberattack on cryptocurrency exchange Binance, calling the claims ‘absurd rhetoric’ and a ‘grave political provocation’ against its image. Source: bbc.co.uk.
What Happened
The attack began when a single engineer’s laptop was compromised. This breach allowed unauthorized access to internal systems and triggered large withdrawals from user accounts.
Trading in major cryptocurrencies resumed after Binance worked with financial issuers to freeze and secure impacted assets.
US and Cyber Agencies Say North Korea Was Behind It
The FBI and Secret Service have publicly linked the breach to North Korea.
Cybersecurity analysts point to the TraderTraitor group as the likely operator. This group is also known as the Lazarus Group.
Key Facts About the Attack
- The breach started with a compromised engineer’s device, showing weak internal access controls.
- Trading has resumed, with assets impacted by the hack now frozen and secured.
- A net $4.72bn has been withdrawn since operations restarted. This is a small fraction of Binance’s total $157bn assets.
- Binance says it has covered about 95% of the stolen funds. That shows strong commitment to user recovery.
- No digital evidence—like encrypted messages or code fingerprints—has been released to confirm North Korean state involvement.
Background: The TraderTraitor Group
TraderTraitor, or the Lazarus Group, previously hacked a major crypto exchange in 2025. That attack set a record at the time.
Research from the S Rajaratnam School of International Studies shows North Korea has built cyber units by recruiting university students. These students are trained under the country’s intelligence agency.
North Korea’s Official Response
Kim Yo Jong, sister of leader Kim Jong Un, dismissed US claims as politically driven.
She said: ‘It is a grave political provocation that the US misleads public opinion by blaming all cyber crimes on North Korea.’
North Korea maintains it opposes all cyber malice and has consistently denied involvement in major attacks.
Industry and Government Actions
The FBI has urged platforms to block transactions from accounts linked to TraderTraitor. This aims to stop further financial damage.
Binance has not directly responded to media questions. It has instead focused on technical recovery and user safety.
Why Attribution Is Difficult
Cyberattacks are hard to trace. Attackers use encryption and anonymizing tools. Digital infrastructure spans global networks.
While US agencies and experts point to the group’s past actions, no definitive proof of state control has been made public.
What to Watch Next
Forensic analysis may reveal whether TraderTraitor operated independently or under state direction.
How platforms respond to transaction blocks could shape future cybersecurity rules.
Public statements from Binance and US agencies may offer clearer answers in the coming weeks.
Sources & further reading
Featured image: This picture taken on February 2, 2026 and released by North Korea's official Korean Central News Agency (KCNA) via KNS on February 3, 2026 shows North Korean leader Kim Jong Un delivering a speech at the inauguration of the Samgwang Stockbreeding Farm in North Pyongan Province, North Korea.. Via original publisher. Image source
