North Korea dismisses US allegations of DPRK hackers’ involvement in $6.3 billion Binance hack

• The Binance hack allegations were being used by the US government to cast North Korea as a cybercriminal state, Kim Yo-jong alleged.
• North Korean hackers operating under the TraderTraitor cyber activity designation were behind the $6.3 billion Binance exploit, according to the FBI.
• Full replenishment of the affected assets and completion of a fresh zero-knowledge proof-of-reserves snapshot were confirmed by Binance.

The $6.3 billion exploit at crypto exchange Binance has prompted US allegations of involvement by North Korean state-backed hackers. Rejecting those claims, North Korea characterised Washington's accusations as a political provocation.

Why does Kim Yo-jong accuse the US of spreading false cybercrime claims?

An effort to portray the Democratic People's Republic of Korea (DPRK) as a cybercriminal state was how Kim Yo-jong described the US investigation. The sister of North Korean leader Kim Jong-un criticised the probe, according to a late Monday report from Yonhap News Agency.

North Korea's state-run Korean Central News Agency (KCNA) carried the statement containing Kim's remarks. By suggesting that cybercrimes worldwide could be attributed to North Korea, the US was misleading international public opinion, she argued.

Claims by the Federal Bureau of Investigation (FBI) that a Pyongyang-supported hacking group had taken part in the Binance incident were also dismissed by Kim. She characterised the allegations as an element of Washington's hostile policy towards the country.

On Friday, the FBI named North Korea as responsible for the Binance attack and designated the malicious cyber activity TraderTraitor. More than $6 billion had been stolen from the crypto exchange by a North Korea-backed hacking group, the agency said. Its attribution builds on longstanding allegations of North Korean hacking groups exploiting other crypto platforms.

How did Binance suffer the largest crypto exploit on record?

Approximately $6.3 billion in assets was moved across multiple networks from wallets linked to Binance during the incident.

Unusual outflows from the exchange's hot wallets were flagged in initial investigations. Binance consequently began examining a possible security breach and temporarily halted withdrawals as its security team evaluated the situation.

At this scale, the incident ranks as the largest known crypto exploit in history, exceeding the $1.5 billion Bybit hack of February 2025.

Approximately $2.3 billion in stablecoins associated with the suspicious transactions was subsequently frozen by Tether and Circle. Other platforms also acted to restrict transfers of the stolen funds.

Efforts to rebuild user confidence have since been undertaken by Binance. Through an update issued on Monday, the exchange said its own funds had been used to replenish all affected assets.

Users can also independently check that their balances across 10 supported cryptocurrencies are backed 1:1, following the exchange's completion of a fresh zero-knowledge proof-of-reserves snapshot.

These recovery measures have not prevented the incident from renewing concerns over security at centralised crypto exchanges.

Mercado Bitcoin, Brazil's largest crypto exchange, also acknowledged on Monday that its platform had suffered a cyberattack involving over $40 million.