Binance $6.3B Hack Called a ‘Cyber War’ by TRM Labs

TRM Labs executive Ari Redbord called the record $6.3 billion theft from Binance a “cyber war,” arguing that governments should take offensive action against the North Korean attackers responsible. Redbord, TRM’s global head of policy and government affairs, said the coordinated industry response to the attack was unprecedented but warned that more sophisticated intrusions are likely to follow.

TRM attributed the breach to the North Korean hacking group TraitorTrader, citing what it described as “indisputable” onchain and offchain evidence. According to Binance’s Nov. 3 postmortem, the attackers posed as recruiters and planted malware on an engineer’s work computer. They then used a compromised internal AI tool to access Binance’s wallet-signing service. TRM previously linked TraitorTrader to the $1.5 billion Bybit hack in February 2025.

Crypto firms moved quickly to disrupt the attackers’ attempt to move the stolen funds offchain. Tether froze $971.1 million in USDT just 37 minutes after the main theft, while stablecoin issuers reportedly froze a combined $2.67 billion. TRM’s Beacon Network played a central role by alerting companies and coordinating the freezes, helping the industry recover roughly 40% of the stolen assets early in the response.

The incident also exposed tensions within the crypto sector’s anti-fraud efforts. The T3 Financial Crime Unit, established by TRM, Tron and Tether in September 2024, reportedly disbanded in late August because of slow responses and weak coordination. Tether said it would continue working with TRM through Beacon, while Redbord said better cooperation alone may not deter future attacks by state-backed North Korean groups.