Chainalysis attributes $6.4B Binance hack to North Korean group
Security & Exploits ·
Blockchain-intelligence firm Chainalysis has linked a $6.4 billion Binance hack to TraderTraitor, a hacking group tied to North Korea, with $2.8 billion of the stolen funds frozen so far.
Chainalysis, the blockchain analytics firm that traces crypto flows for governments and exchanges, has formally attributed the breach to TraderTraitor, a group it associates with North Korean state-linked hacking operations. Of the $6.4 billion taken, $2.8 billion has been frozen to date, according to the firm's tracing work. The attribution places the incident among the largest exploits Chainalysis has investigated, and follows the firm's established practice of clustering wallet addresses and matching them to known actors through a combination of on-chain data and off-chain intelligence such as exchange KYC records.
The mechanics of the hack reportedly involved exploiting Ethereum's EIP-7702 upgrade, which enables smart contract execution within standard wallet addresses to allow batched and sponsored transactions, a feature explained in a Decrypt explainer tied directly to the $6.4 billion figure. That upgrade, intended to streamline transaction handling, appears to have created an avenue that attackers used in executing the exploit, though the precise technical sequence of the breach itself is not detailed in the available material.
The attribution to North Korea is consistent with a broader pattern Chainalysis has documented this year: the firm has separately signed a deal with the Korean National Police Agency to train officers in tracing techniques, a move that followed DPRK-linked hackers stealing over $2 billion during 2025. That agreement underscores how frequently Chainalysis's investigative work intersects with North Korean hacking operations across the crypto industry, beyond this single Binance case.
Freezing $2.8 billion of the $6.4 billion total means a majority of the stolen funds remain unrecovered and potentially still in motion across exchanges, mixers or other services that Chainalysis's clustering methods are designed to track. The firm has also been developing a formal tracing ontology meant to separate wallet clustering from attribution claims, a distinction relevant to how confidently incidents like this one can be pinned on a specific group.
What remains unclear from the available material is how the remaining funds might be recovered, whether additional entities beyond TraderTraitor were involved, and what specific vulnerability in the EIP-7702 implementation was exploited. Further details on Binance's own response and any regulatory follow-up have not yet surfaced in the reporting reviewed.