North Korea dismisses US allegations of DPRK hacker involvement in $6.3 billion Binance hack

• The Binance hack allegations were being used by the US government to depict North Korea as a cybercriminal state, Kim Yo-jong claimed.
• The $6.3 billion Binance exploit was carried out by North Korean hackers operating under the TraderTraitor cyber activity designation, according to the FBI.
• Full replenishment of the affected assets and completion of a fresh zero-knowledge proof-of-reserves snapshot were confirmed by Binance.

The $6.3 billion exploit at crypto exchange Binance has prompted a dispute over US allegations that North Korean state-backed hackers carried out the attack. North Korea rejected the claims, calling Washington's accusations a political provocation.

Kim Yo-jong challenges US cybercrime claims as false

The US investigation drew criticism from Kim Yo-jong, sister of North Korean leader Kim Jong-un, who claimed it sought to depict the Democratic People's Republic of Korea (DPRK) as a cybercriminal state. Her comments were reported late on Monday in a report by Yonhap News Agency.

In a statement published by North Korea's state-run Korean Central News Agency (KCNA), Kim accused the US of misleading international public opinion by linking cybercrimes worldwide to North Korea.

Claims by the Federal Bureau of Investigation (FBI) that a Pyongyang-backed hacking group had participated in the Binance incident were also dismissed by Kim. She characterised the allegations as an element of Washington's hostile policy towards the country.

On Friday, the FBI attributed the Binance attack to North Korea, designating the malicious cyber activity TraderTraitor. More than $6 billion had been stolen from the crypto exchange by a North Korea-backed hacking group, the agency said. Its findings add to longstanding allegations of North Korean hacking groups exploiting other crypto platforms.

Binance hit by the biggest recorded crypto exploit

Approximately $6.3 billion in assets was moved across multiple networks from wallets linked to Binance during the incident.

After preliminary investigations detected abnormal outflows from its hot wallets, Binance began examining a possible security breach. Withdrawals were temporarily halted as the exchange's security team evaluated the situation.

Surpassing the $1.5 billion Bybit hack of February 2025, the incident ranks as the largest known crypto exploit in history.

Approximately $2.3 billion in stablecoins associated with the suspicious transactions was subsequently frozen by Tether and Circle. Other platforms also acted to restrict transfers of the stolen funds.

To rebuild user confidence, Binance has since taken steps to address the losses. In its announcement on Monday, the exchange said its own funds had been used to replenish all affected assets.

A fresh zero-knowledge proof-of-reserves snapshot was also completed by the exchange. This enables users to check independently that their balances across 10 supported cryptocurrencies were backed 1:1.

The recovery measures have not prevented renewed concerns about the security of centralised crypto exchanges following the incident.

Mercado Bitcoin, Brazil's largest crypto exchange, also confirmed on Monday that its platform had suffered a cyberattack involving over $40 million.