Binance $6.3B Hack a ‘Cyber War,’ TRM Labs Exec Says

TRM Labs executive Ari Redbord called on governments to take offensive action against North Korean hackers following the record $6.3 billion Binance theft, describing the incident as a “cyber war.” TRM attributed the attack to the North Korean group TraitorTrader, citing what it called “indisputable” onchain and offchain evidence. The same group was linked to the $1.5 billion Bybit hack in February 2025.

Binance’s Nov. 3 postmortem said the attackers posed as recruiters and planted malware on an engineer’s work computer. They then used a compromised internal AI tool to reach Binance’s wallet-signing service, highlighting the growing role of AI systems and social engineering in large-scale crypto theft.

The industry’s response was unusually fast. Tether froze $971.1 million in USDT just 37 minutes after the main sweep, while stablecoin issuers reportedly froze a combined $2.67 billion, allowing roughly 40% of the stolen funds to be recovered or immobilized. TRM’s Beacon Network, launched in 2025, enabled companies to share alerts and coordinate before attackers moved the assets offchain.

Redbord warned that the response may not deter future attacks and expects the industry to face more incidents. His comments came as Bloomberg reported that the T3 Financial Crime Unit—formed by TRM Labs, Tron and Tether in September 2024—disbanded in late August because of slow responses and poor coordination. Tether said it would continue working with TRM through Beacon.