AI-verified — may contain errors. The verdicts and explanations on this page are generated automatically by AI. Always check the sources.

← Back to the article
Fact check

North Korea denies being behind record $6.3bn Binance hack

BBC News Read the original

10.0 / 10 Well supported

The score shows how well the checked facts are backed by independent sources at the time of the check. It is not a verdict of absolute truth, and not a rating of the publisher.

High confidence How is this calculated?

12 facts found in the article, 8 checked

Article published

Checked with claude-haiku-5-5 · Method 2026-10-10.

Verified facts

  1. Confirmed Kim Yo-jong, sister of North Korean leader Kim Jong Un, said the accusations that North Korea was behind the Binance hack are another "sinister attempt" by the US to damage the country's public image.

    AI The Korea Herald report quotes Kim Yo-jong calling Washington's accusation a "sinister" attempt to damage the international image, matching the claim's core. The snippet is cut off, so the exact wording of "public image" could not be checked, but the meaning matches. Other results (SCMP, NK News, The Hill, AP) confirm her statement denying North Korean involvement and calling the accusations a provocation, though they do not show the word "sinister".

  2. Confirmed The US Federal Bureau of Investigation (FBI), the Secret Service and cyber analysts said North Korea orchestrated the Binance hack of about $6.3bn.

    AI Multiple results report that the FBI blamed North Korea-linked TraderTraitor for the roughly $6.3bn Binance theft, and blockchain investigators also tied it to North Korea. None of the results mention the Secret Service, so that part of the claim could not be checked.

  3. Confirmed The FBI and blockchain analysts said the Binance attack was led by the state-backed hacking group TraderTraitor.

    AI The FBI statement, as reported in several results, attributes the Binance theft to North Korea's state-sponsored unit TraderTraitor, and blockchain firms TRM Labs and Chainalysis (via its CEO) also named TraderTraitor. The results do not cover every detail of the claim, but the core attribution to TraderTraitor is directly supported. Most of the FBI reporting traces back to the same FBI statement, so the support is largely a single original source.

  4. Confirmed The FBI called on industry partners to help block transactions involving cryptocurrency accounts linked to TraderTraitor.

    AI Several results report that the FBI asked private-sector partners, such as crypto exchanges, blockchain analytics firms, and DeFi operators, to block transactions linked to addresses used by TraderTraitor to launder stolen assets. The results describe blocked addresses rather than 'accounts,' which is a wording difference only. Results 1, 4 and 5 appear to repeat the same Reuters-sourced FBI statement, while result 3 (CoinDesk) directly quotes the FBI's call to private-sector entities.

  5. Confirmed TraderTraitor, also known as the Lazarus Group, was blamed for a $1.5bn hack of crypto exchange Bybit in 2025.

    AI The FBI alert explicitly attributes the roughly $1.5 billion Bybit theft on or about February 21, 2025 to North Korea and calls the activity "TraderTraitor." Al Jazeera reports that TRM assessed TraderTraitor as the attacker and describes it as linked to the Lazarus Group. The Wiz blog also ties TraderTraitor to the ~$1.5 billion Bybit hack, though it places the hack in "late 2024," which conflicts with the 2025 date in the claim and the FBI.

  6. Confirmed Binance said initial checks indicated that an engineer's laptop had been compromised, enabling an attacker to make unauthorised withdrawals.

    AI Several results report that Binance's initial statement said a compromised engineer's laptop could have let an attacker reach internal systems and submit unauthorised withdrawals. The results describe this as a possibility ('may have'), not a confirmed finding, so the claim's wording is slightly stronger than the sources, but the core facts match. Several sources appear to repeat the same initial Binance statement.

  7. Confirmed Binance said on Sunday that customers pulled out more than $3.6bn of assets after the exchange reopened following the suspension of all transactions.

    AI The results report that Binance customers withdrew more than $3.6bn after the exchange reopened on Sunday following a suspension of all transactions, which matches the claim's figure, date and event. The snippets do not explicitly say the figure came from a Binance statement, though one mentions "It added", and both matching results repeat the same BBC report.

  8. Confirmed Binance has covered around 95% of the assets stolen in the breach.

    AI Multiple results report that Binance said it had covered about 95% of the roughly $6.3 billion stolen in the breach, which matches the claim. These sources all relay Binance's own announcement rather than independent verification of the coverage figure.

Not checked

We check a limited number of facts per article to keep the service free. These don’t count towards the score.

Author’s assumptions

Predictions or inferences in the article. They can’t be fact-checked.

Opinions

Views and judgements, the author’s or someone quoted. Not fact-checked.

How we handle corrections

Report an error