$6.3 billion Binance hack: North Korea dismisses US claims linking DPRK hackers to the attack

• The Binance hack allegations were being used by the US government to depict North Korea as a cybercriminal state, Kim Yo-jong alleged.
• The $6.3 billion Binance exploit was linked by the FBI to North Korean hackers operating under the TraderTraitor cyber activity designation.
• Full replenishment of the affected assets and completion of a fresh zero-knowledge proof-of-reserves snapshot were confirmed by Binance.

The Binance exploit targeted $6.3 billion in assets. North Korea rejected US allegations that state-backed hackers were behind the attack on the crypto exchange, calling Washington's accusations a political provocation.

Kim Yo-jong rejects US cybercrime claims as false

The US investigation sought to depict the Democratic People's Republic of Korea (DPRK) as a cybercriminal state, claimed Kim Yo-jong, sister of North Korean leader Kim Jong-un. Her criticism was detailed in a late Monday report from Yonhap News Agency.

In a statement published by North Korea's state-run Korean Central News Agency (KCNA), Kim accused the US of misleading international public opinion. She said Washington was suggesting that North Korea was responsible for cybercrimes committed worldwide.

Claims by the Federal Bureau of Investigation (FBI) that a Pyongyang-backed hacking group took part in the Binance incident were also rejected by Kim. She characterised the allegations as an extension of Washington's hostile policy towards the country.

On Friday, the FBI attributed the Binance attack to North Korea and designated the malicious cyber activity TraderTraitor. More than $6 billion was stolen from the crypto exchange by a North Korea-backed hacking group, the agency said. Its attribution adds to longstanding allegations linking North Korean hacking groups to exploits at other crypto platforms.

Binance records the biggest crypto exploit to date

Approximately $6.3 billion in assets moved across multiple networks from wallets linked to Binance during the incident.

Unusual outflows from the exchange's hot wallets were detected in initial investigations. Binance then began examining a possible security breach and temporarily halted withdrawals as its security team evaluated the situation.

By scale, the attack ranks as the largest known crypto exploit in history, exceeding the $1.5 billion Bybit hack of February 2025.

Following the suspicious transactions, approximately $2.3 billion in linked stablecoins was frozen by Tether and Circle. Other platforms also acted to restrict transfers of the stolen funds.

Efforts to rebuild user confidence have since followed. In its announcement on Monday, Binance said its own funds had been used to replenish all affected assets.

A fresh zero-knowledge proof-of-reserves snapshot was also completed by the exchange. Users can independently check that their balances across 10 supported cryptocurrencies have 1:1 backing.

These recovery measures did not prevent the incident from renewing concerns over the security of centralised crypto exchanges.

An attack involving over $40 million at Mercado Bitcoin, Brazil's largest crypto exchange, was also confirmed by the platform on Monday.