Binance Hack Update: Ripple Freezes $200 Million As Recovery Hits $3 Billion Amid North Korea Link

The recovery effort after the $6.3 billion Binance exploit is picking up pace. Ripple has frozen about $200 million connected to the attack, according to Binance co-founder Yi He. Binance says about $3 billion of the stolen funds has now been frozen in total.

A new on-chain finding has also raised the stakes. Blockchain investigator ZachXBT says the attacker appears to be the same one behind the recent $388 million Bitget hack, which has been attributed to hackers linked to North Korea.

Who Has Frozen What

Stablecoin issuers and blockchain networks moved quickly to lock up stolen funds:

• Ripple: about $200 million, frozen “promptly,” according to Yi He
• World Liberty Financial: $27 million in USD1 and 48 million WLFI tokens, worth about $2 million
• Arbitrum Security Council: about $30.5 million, frozen through an on-chain transaction
• Total frozen: about $3 billion, according to Binance

Binance said it is working with law enforcement, token issuers, blockchain analytics firms and industry partners to trace and freeze more assets. It added that it will only share confirmed figures.

ZachXBT Points To North Korea-Linked Group

ZachXBT said funds from the Binance exploit and the Bitget exploit were combined at the same wallet address after passing through THORChain, a cross-chain swap protocol. In his view, that suggests a single actor is behind both attacks.

The Bitget hack has been attributed to TraderTraitor, a hacking group linked to North Korea. ZachXBT said the group has also been tied to earlier attacks, including the Kelp DAO exploit.

How The Attack Worked

Early on-chain analysis suggests the hacker used EIP-7702, a feature added in Ethereum’s Pectra upgrade. It allows an ordinary wallet to act like a smart contract for a short time, as long as the request is signed with a valid private key.

The attacker’s method, as described by on-chain researchers:

• Collected 50 signed EIP-7702 authorizations in advance, each with a different sequential nonce
• Did not know which nonce would be valid at the moment of the attack
• Submitted all 50 at once, so that one of them would match

Only one needed to work, and one did.

Binance said the breach had “multiple factors.” Its security team is tracing the full attack path through a compromised computer that may have been the entry point. The exchange promised a full report on the root cause.

What It Means For Binance Users

• Losses: Binance says it will cover all hacking losses and that user funds are safe.
• Deposits: working normally.
• Withdrawals: still paused while Binance rebuilds its withdrawal system and related addresses, with a restart expected within 48 hours.
• Updates: users are urged to follow only official Binance channels.