A senior executive at blockchain intelligence firm TRM Labs has characterized the recent $6.3 billion breach of cryptocurrency exchange Binance as an act of "cyber war," attributing the attack to a North Korean state-sponsored hacking group.
Ari Redbord, head of policy and government relations at TRM Labs, stated that the incident represents a significant escalation in state-backed digital theft. The firm attributed the attack to TraitorTrader, a North Korean hacking collective, citing what it described as indisputable onchain and offchain evidence.
Attack vector and response
Binance released a postmortem on Nov. 3 detailing the intrusion. The exchange said attackers posed as recruiters to plant malware on an engineer’s work computer. The compromised device was then used to access an internal artificial intelligence tool, which provided the entry point to Binance’s wallet-signing service.
In response to the theft, stablecoin issuers executed a coordinated freeze of illicit funds. Tether froze 971.1 million USDt (USDT) tokens just 37 minutes after the main sweep of funds from Binance wallets. According to TRM Labs, stablecoin issuers collectively froze tokens worth approximately $2.67 billion.
Redbord noted that this rapid coordination allowed responders to claw back 40% of the stolen funds immediately. He credited the Beacon Network, an intelligence-sharing system launched by TRM in 2025, for enabling companies to immobilize the assets quickly before working to seize them.
Widening capacity gap
The push for tighter industry coordination comes amid reports of friction in previous collaborative efforts. Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit, a partnership formed by TRM, Tron and Tether in September 2024, disbanded in late August. Sources cited slow responses and poor coordination as reasons for the dissolution.
TRM Labs’ latest capacity gap report indicates that the disparity between attackers and cybersecurity defenders is widening. The firm attributes this trend to hackers’ early adoption of frontier technologies, including AI, which enhances their ability to bypass traditional security measures.
Redbord highlighted the scale of state-sponsored theft, noting that North Korea’s Oct. 29 theft alone was equivalent to roughly one-third of the country’s gross domestic product. He added that this single incident accounted for half of the $12.5 billion stolen by state-backed hackers since 2017.
