North Korea rejects US allegations linking DPRK hackers to $6.3 billion Binance hack

• Kim Yo-jong accused the US government of using the Binance hack allegations to portray North Korea as a cybercriminal state.
• The FBI attributed the $6.3 billion Binance exploit to North Korean hackers operating under the TraderTraitor cyber activity designation.
• Binance confirmed it had fully replenished affected assets and completed a new zero-knowledge proof-of-reserves snapshot.

North Korea has pushed back against US allegations that state-backed hackers were responsible for the $6.3 billion exploit targeting crypto exchange Binance, describing Washington's accusations as a political provocation.

Kim Yo-jong accuses the US of spreading false cybercrime allegations

Kim Yo-jong, the sister of North Korean leader Kim Jong-un, criticized the US investigation, claiming it was an attempt to portray the Democratic People's Republic of Korea (DPRK) as a cybercriminal state, according to a late Monday report by Yonhap News Agency.

Kim made the remarks in a statement carried by North Korea's state-run Korean Central News Agency (KCNA). She argued that the US was misleading international public opinion by suggesting that cybercrimes committed around the world were attributable to North Korea.

Kim also rejected the Federal Bureau of Investigation's (FBI) claims that a hacking group supported by Pyongyang was involved in the Binance incident, describing the allegations as part of Washington's hostile policy toward the country.

The FBI on Friday identified North Korea as responsible for the attack on Binance, calling the malicious cyber activity TraderTraitor. The agency said a North Korea-backed hacking group stole more than $6 billion from the crypto exchange. The attribution adds to longstanding allegations that North Korean hacking groups have exploited other crypto platforms.

Binance suffers the largest crypto exploit on record

The Binance incident involved the movement of approximately $6.3 billion in assets from exchange-linked wallets across multiple networks.

Initial investigations identified unusual outflows from the exchange's hot wallets, prompting Binance to look into a potential security breach and temporarily suspend withdrawals while its security team assessed the situation.

The scale of the incident makes it the largest known crypto exploit in history, surpassing the $1.5 billion Bybit hack in February 2025.

Tether and Circle subsequently froze approximately $2.3 billion in stablecoins linked to the suspicious transactions, while other platforms also took measures to limit the movement of stolen funds.

Binance has since moved to restore user confidence. In an announcement on Monday, the exchange noted that it had fully replenished the affected assets using its own funds.

The exchange also completed a new zero-knowledge proof-of-reserves snapshot, allowing users to independently verify that their balances in 10 supported cryptocurrencies were backed 1:1.

Despite the recovery efforts, the incident raised fresh concerns about the security of centralized crypto exchanges.

Brazil's largest crypto exchange, Mercado Bitcoin, also confirmed an over $40 million cyberattack on its platform on Monday.