Chainalysis links North Korea's TraderTraitor to $6.4B Binance breach
Tech & Launches ·
Blockchain-intelligence firm Chainalysis has attributed a $6.4 billion hack affecting Binance to TraderTraitor, a hacking group tied to North Korea, with $2.8 billion of the stolen funds frozen to date.
The attribution places the incident among the largest crypto thefts tracked by investigators, with the bulk of the funds still unrecovered despite the freezes. Chainalysis, a New York-based blockchain analysis firm founded in 2014, builds its case through transaction tracing and address clustering that connects on-chain movement of funds to known actor typologies, a method it has applied to prior North Korea-linked thefts exceeding $2 billion in 2025 alone.
The scale of the breach has already drawn regulatory attention in Washington. CFTC Chair Michael Selig has pointed to the incident as evidence that offshore exchanges should register with U.S. regulators and adhere to American cybersecurity standards, an argument he laid out in a CNBC interview reported by Decrypt. Selig has floated a federal registration option for crypto exchanges as a policy response, framing the Binance incident as a case study for tighter oversight of platforms operating outside U.S. jurisdiction.
The hack adds to a pattern of North Korea-linked attribution work from Chainalysis, which has separately signed a deal with South Korea's National Police Agency to train officers in tracing techniques following DPRK-linked thefts topping $2 billion in 2025. The firm has also recently traced a separate $25 million exploit against Resolv to a compromised AWS key used to mint 80 million unbacked USR tokens, underscoring its broader role in attributing exploits across the industry beyond state-linked actors.
What remains unclear is how the remaining funds beyond the $2.8 billion already frozen will be pursued, and whether the attribution to TraderTraitor will shape any near-term regulatory action beyond Selig's public remarks. It is also not yet established what concrete registration framework, if any, regulators will propose for offshore exchanges, or how Binance itself has responded to the breach and the frozen-asset total. Further disclosures from Chainalysis, Binance or U.S. regulators would clarify both the final scope of losses and any policy follow-through.