According to the FBI, North Korea took $6.4 billion from Binance. Pyongyang's response: Washington says this every time. On Monday, Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the U.S. accusation and described the FBI's claims as a political attack on her country. KCNA, the state news agency, ran her statement on Tuesday.“As regards this extra-large incident, the U.S. has made a trite provocation of linking it with the Democratic People's Republic of Korea again,” she said. She added: “The FBI is trying to brand the DPRK as a ‘cyber criminal state,’” and called the accusation “absurd rhetoric and noting new.”Her charge was that Washington points at North Korea whenever a large cybercrime takes place. She also challenged the U.S. attribution of the $1.5 billion Bybit hack in February 2025, which the FBI tied to the same group, TraderTraitor. The FBI's public case so farA few days before her statement, the FBI said TraderTraitor, a North Korean hacking operation, was behind the Oct. 29 theft from Binance. The bureau named cryptocurrency addresses connected to the stolen funds and asked exchanges and blockchain services to block any transactions involving them. What's been made public only goes so far. The FBI has not published its full forensic findings on the Binance attack. Its October 31 alert lists wallet addresses it says are controlled by, or connected to, North Korean hackers. In separate work, blockchain investigators have linked the hack to North Korea's Lazarus Group. Elliptic followed the stolen funds across thousands of wallets and found signs of automated laundering. It did not find proof that AI agents were directing the transactions. Chain data can name an actor, not a countryVasily Vidmanov, COO and head of investigations at AMLBot, said there's a ceiling on what chain analysis can show.“Onchain analysis can link wallets to one actor. It can’t prove nationality or state sponsorship,” Vidmanov said. “The evidence supporting the DPRK attribution is cumulative and goes well beyond speculation.”He noted that stolen funds from both the Binance and Bitget hacks landed in shared wallets. Investigators say that overlap ties the two attacks together. In Vidmanov's view, a press release won't be the best answer to Kim. “The most useful evidence here against the denial is what happens to the money next,” he said. “If it follows the same laundering route we’ve seen happen in earlier thefts attributed to North Korea, through swaps into bitcoin and then through OTC brokers, the laundering will answer the denial better than any statement.”Years of sanctions and indictmentsThe U.S. has spent years linking crypto thefts to hackers tied to the North Korean state, and it has issued sanctions and criminal charges along the way. Should the FBI's attribution stand, Binance would mark a steep rise in the amount of cryptocurrency the group has stolen. The U.S. Treasury sanctioned Lazarus Group, Bluenorff and Andariel in 2019, saying North Korea's military intelligence agency controlled all three hacking groups. In 2021, the Justice Department charged three North Korean military hackers with attempting to steal or extort more than $1.3 billion from banks and businesses, including cryptocurrency companies. In 2023, Treasury targeted the money-moving infrastructure by sanctioning the crypto mixer Sinbad. It described the service as “a key money-laundering tool of the OFAC-designated Lazarus Group”, used by Korean hackers to launder proceeds from the $620 million Axie Infinity theft and other attacks. Pyongyang always deniesNorth Korea has rejected involvement in every major cyberattack attributed to it. A 2024 United Nations report and research from the Center for a New American Security both found that the country recruits students with strong mathematics and computing skills for cyber operations and places some of them in its military intelligence agency. Requests for comment on Kim's statement have gone to the FBI, Binance, Elliptic and TRM Labs.