North Korea test-fires cruise missiles and denies FBI claim it hacked Binance

North Korea said it test-fired strategic cruise missiles carrying a new cluster-munition warhead on Monday, while its leadership rejected US accusations that Pyongyang stood behind the record theft from the Binance cryptocurrency exchange. The Korean Central News Agency reported the launch on Tuesday, as Euronews, the BBC and CNBC covered the hacking denial.

Denial from Kim’s sister

Kim Yo Jong, the sister of leader Kim Jong Un, called the allegation “absurd rhetoric” and a “grave political provocation”, according to the BBC and CNBC. She accused Washington of misleading international opinion by presenting cybercrime around the world as North Korean work. The BBC reported that she described the claim as a “sinister attempt” to damage her country’s image.

On Saturday the FBI said a North Korea-affiliated group called TraderTraitor was responsible, according to Euronews. The BBC said the Secret Service and cyber analysts share that view, and that the FBI has asked industry partners to help block transactions involving accounts tied to the group. The same unit, also known as the Lazarus Group, was blamed for a $1.5bn hack of the Bybit exchange in 2025, the BBC noted.

How the money moved

CNBC said the blockchain analytics firms Elliptic and Chainalysis have likewise linked the theft and the movement of the funds to North Korea-linked actors. Elliptic reported that in the first four days the hackers used roughly 12,000 wallets across 11 blockchains and made more than 40,000 transactions, with a new wallet appearing about every 25 seconds.

Elliptic put the total stolen at $6.43 billion. About $2.85 billion, or 44%, has been frozen or seized, while about $3.24 billion remains in addresses tied to the theft, mostly in bitcoin and ether. Only a negligible amount appears to have been cashed out. Elliptic expects the rest to be converted gradually over several months.

Binance has said an engineer’s laptop was compromised, enabling unauthorised withdrawals, according to the BBC. The exchange says it has covered around 95% of the stolen assets and, per CNBC, is progressively reopening withdrawals for more assets.

The missile test

KCNA said the cruise missiles carried a middle-sized dispersal warhead able to devastate a target area of 5 to 6 hectares, and that the test improved terminal manoeuvrability for a vertical strike. A North Korean official was quoted as saying the armed forces must defend the country and deter threats.

Lim Eul-chul, a professor at Kyungnam University, told AFP that the weapon shows Pyongyang could disable airfield runways, radar bases and air defence batteries with a single missile, and amounts to a “double deterrence” below the nuclear threshold. Michael Bosack, a former UN Command official, told the agency that the hack denial probably aims to keep channels for laundering the funds open.

South Korea’s military did not announce Monday’s launch or an earlier one on Sunday. Joint Chiefs spokesperson Jang Do-young said Seoul and Washington were analysing the Sunday test closely, adding that not every North Korean projectile is announced for operational security reasons. Unlike ballistic missile launches, cruise missile tests are not barred by UN Security Council sanctions, Euronews noted.

What happens next

South Korean President Lee Jae-myung used the episode to urge a comprehensive prevention system against cyberattacks. A 2024 UN report said North Korean cyber proceeds had reportedly helped fund weapons of mass destruction, Euronews recalled. Much of the stolen money has yet to be traced to final destinations, and Elliptic expects the laundering to continue.