Chainalysis Links $6.4 Billion Binance Hack to North Korea

Attribution and Scope

Chainalysis published analysis linking the $6.4 billion Binance theft to North Korean-linked threat actors, citing on-chain transaction patterns and wallet behavior consistent with previous campaigns attributed to the regime. The attack represents one of the largest single cryptocurrency thefts documented to date, surpassing the $625 million Ronin bridge exploit of 2022 and the $570 million Poly Network attack of 2021.

Current Fund Status

Binance disclosed that $3 billion of the stolen assets have been frozen on-chain through coordination with exchanges and on-chain monitoring firms. Customer withdrawals remain suspended as the exchange assesses the scope of affected accounts and reserves. Binance has not provided a public timeline for resuming withdrawal services or disclosed whether additional funds have been recovered through law enforcement channels.

Historical Context

North Korean state-sponsored groups have conducted sustained campaigns against cryptocurrency infrastructure, including the 2018 Coincheck hack ($530 million) and the 2022 Ronin bridge attack ($625 million). U.S. and U.N. officials have previously attributed these campaigns to the Lazarus Group and affiliated units, which use stolen cryptocurrency to finance weapons development and evade international sanctions.