Binance $6.3B Hack: TRM Exec Calls North Korea Attack ‘Cyber War’

The $6.3 billion theft from Binance has been characterized as a “cyber war” by TRM Labs global head of policy and government affairs Ari Redbord, who urged governments to take offensive action against the North Korean hacking group responsible. TRM attributed the attack to TraitorTrader, citing what it described as indisputable onchain and offchain evidence.

Attackers reportedly impersonated recruiters to install malware on a Binance engineer’s work computer. They then used a compromised internal AI tool to access the exchange’s wallet-signing service, according to Binance’s Nov. 3 postmortem. TRM also linked TraitorTrader to the $1.5 billion Bybit hack in February 2025.

The crypto industry’s response was unusually rapid. Tether froze $971.1 million in USDT just 37 minutes after the main theft, while stablecoin issuers reportedly froze about $2.67 billion in total, recovering roughly 40% of the stolen funds. TRM’s Beacon Network enabled participating companies to coordinate and immobilize assets across multiple blockchains before the hackers could move them offchain.

Redbord said the industry should expect more large-scale attacks despite the rapid recovery effort. He also noted that better coordination alone may not deter North Korea, while the reported disbandment of the T3 Financial Crime Unit—which TRM formed with Tron and Tether—raised concerns about slow responses. Tether, however, said it would continue working with TRM through Beacon.