FBI and analysts identify TraderTraitor as attack leader
On Tuesday, North Korea denied responsibility for the record $6.3bn (£4.7bn) hack of cryptocurrency exchange Binance, calling the allegations “absurd rhetoric”. Kim Yo-jong, the director of North Korea’s General Affairs Department and sister of leader Kim Jong Un, said the accusations were another “sinister attempt” by the US to damage the country’s public image.
Her statement characterized the US allegation as political provocation. “The US has made a trite provocation of linking it with the Democratic People’s Republic of Korea again,” she said. She also said: “It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.”
The FBI, Secret Service and cyber analysts said North Korea orchestrated the hack, describing it as the largest in history. The attribution focused on responsibility for the breach and the identity of the state-linked unit that carried it out.
Blockchain analysts and the FBI said the attack was led by the state-backed hacking group TraderTraitor. The unit is also known as the Lazarus Group.
The Lazarus Group was blamed for the then-record $1.5bn hack of crypto exchange Bybit in 2025. The attribution to the same unit placed the Binance theft within the group’s previously alleged operations.
North Korea has also been blamed for a number of major cyber attacks, accusations it has consistently denied.
The FBI has called on industry partners to help block transactions involving cryptocurrency accounts linked to TraderTraitor.
The BBC contacted Binance for comment. Since the hack, the crypto giant has largely focused its public statements on the technical nature of the breach and its response to protect users.