Chainalysis attributes $6.4B Binance hack to North Korea's TraderTraitor
Security & Exploits ·
Blockchain-intelligence firm says $2.8 billion of the stolen funds have been frozen so far, as US officials review the attribution.
Chainalysis has linked a $6.4 billion breach at Binance to TraderTraitor, a hacking group tied to North Korea, and says $2.8 billion of the stolen assets have been frozen to date. The figure places the incident among the largest crypto thefts tracked by the firm, which built its reputation tracing illicit blockchain flows for governments and exchanges. The $6.4 billion Binance hack has drawn scrutiny partly because of its scale relative to prior incidents.
North Korea-linked hacking activity has totaled $9.6 billion since 2019, according to figures circulating alongside the Binance attribution, and the Binance breach alone is said to exceed the combined total of the next nine largest hacks on record. That comparison underscores why the Chainalysis finding carries weight beyond a single case: it reframes how analysts measure the scale of state-linked crypto theft relative to the broader history of exchange and protocol exploits.
The Trump administration is reported to be investigating whether the Binance hack was correctly attributed to North Korea, suggesting the Chainalysis assessment is not yet treated as a closed matter at the policy level. That review sits alongside the firm's own history of attribution work on North Korean hacking, including a separate deal with Korean police to train officers after DPRK-linked actors stole more than $2 billion in 2025, pointing to an expanding role for Chainalysis in state-level responses to these thefts.
The $2.8 billion in frozen funds represents less than half of the total amount Chainalysis says was taken, leaving the bulk of the stolen assets unaccounted for or still in motion. How those remaining funds move, and whether further freezes are possible, depends on the extent to which they pass through services willing or able to act on tracing data, a dynamic Chainalysis's broader toolset is built to exploit through address clustering and entity attribution.
Unresolved is whether the US government inquiry will affirm, qualify or dispute the North Korea attribution, and what that would mean for the freeze efforts already underway. Also unclear from available material is the timeline of the hack itself, how the funds were initially moved out of Binance, and what portion of the $6.4 billion remains traceable versus laundered beyond recovery. Further detail on the mechanics of the exploit and any additional freezes will determine whether the current $2.8 billion figure grows.