North Korea hacked Binance for $6.3B

TRM Labs has attributed the record-breaking $6.3 billion Binance theft to TraitorTrader, a North Korean hacking group already linked to February 2025's $1.5 billion Bybit breach. The blockchain intelligence firm cited what it described as indisputable evidence, both on-chain and off-chain, connecting the attack to state-sponsored operators.

Binance's Nov. 3 post-mortem revealed that attackers used social engineering to compromise an engineer's work device, posing as recruiters to deploy malware. The intruders then exploited a compromised internal AI tool to access the exchange's wallet-signing service.

Ari Redbord, TRM Labs' global head of policy and government affairs, warned that despite an unprecedented industry response, such incidents will only intensify.

Coordinated freeze captures 40 percent of stolen assets

The industry's reaction to the Binance breach marked a turning point in speed and coordination. Tether froze 971.1 million USDt just 37 minutes after the primary fund sweep, part of a combined $2.67 billion in stablecoins immobilized by multiple issuers. Redbord emphasised that no previous incident had seen such rapid action, with 40 percent of the stolen amount locked before hackers could move it off-chain.

TRM's Beacon Network, launched in 2025 to enable real-time intelligence sharing among companies, played a central role in the response. Redbord noted that alert volume through the platform surged from a typical handful per day to hundreds, possibly a thousand, in the days following the attack. The system allowed firms to act in concert, immobilizing funds before seizure efforts could begin.

The coordination push follows the late-August dissolution of the T3 Financial Crime Unit, a partnership TRM established with Tron and Tether in September 2024. Bloomberg reported on Nov. 4 that slow responses and poor coordination led to the group's disbanding. Tether confirmed it would maintain its collaboration with TRM through the Beacon Network.

Redbord cautioned that even successful recovery efforts may not deter future attacks. The Oct. 29 theft represented roughly one-third of North Korea's GDP and accounted for half of the $12.5 billion stolen by state-backed hackers since 2017. Even if attackers recover only $1 billion from the Binance breach, the potential return remains substantial enough to justify continued operations.

Call for government-led offensive operations

Redbord argued that defensive measures alone cannot counter state-sponsored hacking campaigns. He called for governments to respond with offensive cyber operations targeting North Korea's hacking infrastructure, as well as the laundering networks and financial institutions hackers rely on to convert stolen assets into usable currency.

TRM's capacity gap report identified a widening disparity between attackers and defenders, driven by hackers' rapid adoption of emerging technologies such as AI. Redbord stressed that law enforcement and compliance teams require AI capabilities to identify and remediate vulnerabilities at the same pace adversaries exploit them.

He framed the situation as a conflict requiring a military-grade response. Governments should retaliate with cyber strikes each time North Korea conducts a hack, he said, characterising the ongoing campaign as cyber warfare rather than criminal activity. Without offensive action targeting the state apparatus behind these operations, he argued, North Korea will continue exploiting the financial rewards as long as the model proves effective.