TRM Labs executive calls $6.3 billion Binance hack cyber war

Record Binance theft prompts call for offensive action

TRM Labs executive Ari Redbord has called the $6.3 billion Binance hack cyber war. He urged governments to take offensive action against North Korean hackers.

Binance is described in the source as the world's biggest crypto exchange, a platform where people buy and sell crypto. Redbord, TRM Labs' global head of policy and government affairs, spoke to Cointelegraph after the theft.

He said the industry's coordinated response was unprecedented. He also warned, "we are only going to see much more of this."

Key numbers from the industry response

• $6.3 billion was taken in the Binance theft, according to the source.
• Tether froze 971.1 million USDt tokens 37 minutes after the main sweep.
• Stablecoin issuers combined froze tokens worth about $2.67 billion, according to TRM. A stablecoin is a token designed to hold a steady value.
• Redbord said companies were able to claw back 40% right out the gate.
• TRM said the Oct. 29 theft was equivalent to roughly a third of North Korea's GDP, as stated by Redbord.

What Binance and TRM Labs reported

Binance said in its postmortem on Nov. 3 that attackers posed as recruiters to plant malware on an engineer's work computer. The company said the attackers then used a compromised internal AI tool to reach its wallet-signing service. A wallet holds crypto, and a wallet-signing service approves transfers from it.

TRM Labs, a blockchain intelligence company, released a report after the attack. TRM said it was early to attribute the attack to North Korean hacking group TraitorTrader. TRM cited what it called indisputable onchain and offchain evidence. Onchain means data recorded on a blockchain, a shared public record.

The source says the $1.5 billion hack of Bybit in February 2025 was attributed to the same group.

How companies coordinated to freeze funds

Redbord said the speed and scale of the response stood out. He said, "Nothing like that has ever been done before."

He explained that the Beacon Network, an intelligence-sharing system TRM launched in 2025, allowed companies to coordinate quickly. The aim was to immobilize funds before working to seize them. The race to catch stolen funds before hackers can move them offchain is a critical part of defense, he said.

Redbord said, "Normally I see a few Beacon alerts maybe every day. I've seen, I don't know, hundreds or maybe even a thousand Beacon alerts over the last few days."

Report of a separate unit disbanding

Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit disbanded in late August. The source says TRM formed that unit with Tron and Tether in September 2024. Bloomberg sources cited slow responses and poor coordination, according to the source.

Tether said it would continue working with TRM through Beacon, according to the source.

Why Redbord wants a shift to offense

Redbord argued that stopping such attacks requires offensive action from governments. He said North Korean hackers operate as an arm of the state.

TRM's capacity gap report found that the gap between attackers and cybersecurity defenders continues to widen. The source says this is driven by hackers' early adoption of frontier technologies such as AI. Redbord said law enforcement and compliance teams need AI to find and patch vulnerabilities as quickly as hackers can exploit them.

He said, "Every time North Korea hacks, we should be hacking them back." He called for offensive cyber operations and action against laundering networks and banks that hackers use to cash out. He said, "This is cyber war."

He also argued that the potential payoff remains enormous even if attackers recover only $1 billion. He said, "North Korea will keep doing this as long as it's effective."

Article source

• Cointelegraph