The ChaCha stream cipher has become one of the best-known symmetric ciphers because of its widespread adoption in several systems, such as in TLS, SSH, Noise, IKE, IPsec and so on. In this paper, we propose a two-layer framework of PNB-based key recovery attacks on ChaCha, called TwoLayerF. By applying TwoLayerF, we achieve a significantly improved key recovery attack on 6-round ChaCha256 with a time complexity of \({{2}^{77.16}}\) . It is \({{2}^{22.32}}\) times faster than the previous best attack. We also present a key recovery attack on 6.5-round ChaCha256 with a time complexity of \({{2}^{122.47}}\) .