TRM Labs: Binance Hack is 'Cyber War'

Governments Urged to Pursue Offensive Cyber Operations Against North Korean Hackers Following Record Binance Theft

New York, NY – Following the unprecedented $6.3 billion theft from cryptocurrency exchange Binance, a leading blockchain intelligence firm is calling for governments to adopt a more aggressive stance against North Korean state-sponsored hacking operations. Ari Redbord, global head of policy and government affairs at TRM Labs, argued that a purely defensive strategy is insufficient to counter the escalating threat posed by Pyongyang’s cybercrime activities.

The massive Binance hack, which sent shockwaves through the digital asset industry, underscored the growing sophistication and audacity of state-backed hacking groups. TRM Labs, which was instrumental in tracking the stolen funds, identified the North Korean hacking collective “TraitorTrader” as the perpetrator, citing what it described as “indisputable” on-chain and off-chain evidence. This same group was previously linked to a $1.5 billion hack of Bybit in February 2025.

Binance detailed in a postmortem report released November 3 that attackers gained access by posing as recruiters to deploy malware onto an engineer’s work computer. They then leveraged a compromised internal artificial intelligence tool to infiltrate the exchange’s wallet-signing service.

Redbord told Cointelegraph that while the crypto industry’s swift and coordinated response to the Binance hack was remarkable, it is likely only a temporary reprieve. “We are only going to see much more of this,” he warned.

The speed at which the industry mobilized to freeze stolen assets was particularly noteworthy. Tether, for instance, froze 971.1 million USDt (USDT) tokens just 37 minutes after the primary theft. In total, stablecoin issuers froze approximately $2.67 billion in assets, according to TRM Labs. “Nothing like that has ever been done before,” Redbord stated, highlighting that “they were able to claw back 40% right out the gate.”

The ability to intercept stolen funds before they are moved off-chain is a crucial element of defense. Redbord explained that TRM’s Beacon Network, an intelligence-sharing platform launched in 2025, facilitated rapid coordination among companies to immobilize the funds. “Normally I see a few Beacon alerts maybe every day. I’ve seen, I don’t know, hundreds or maybe even a thousand Beacon alerts over the last few days,” he remarked, illustrating the heightened activity.

This push for enhanced coordination comes amid reports that the T3 Financial Crime Unit, a joint initiative by TRM, Tron, and Tether formed in September 2024, disbanded in late August. Sources cited slow response times and poor coordination as reasons for its dissolution. Tether has indicated it will continue its collaboration with TRM through the Beacon Network.

Despite the industry’s efforts, Redbord cautioned that increased coordination alone may not deter future attacks. He pointed out that North Korea’s October 29th theft represented roughly one-third of the country’s GDP and accounted for half of the $12.5 billion stolen by state-backed hackers since 2017. Even if attackers only manage to recover a fraction of the stolen funds, the potential financial gains remain substantial.

“North Korea will keep doing this as long as it’s effective,” Redbord asserted. He argued that effectively combating these attacks necessitates offensive actions from governments, treating North Korea’s hacking operations as an extension of state policy.

TRM Labs’ recent “capacity gap” report highlighted a widening chasm between attackers and cybersecurity defenders, largely driven by the rapid adoption of advanced technologies like AI by malicious actors. Redbord stressed the urgent need for law enforcement and compliance teams to leverage AI to identify and mitigate vulnerabilities as quickly as hackers can exploit them.

“Every time North Korea hacks, we should be hacking them back,” he declared, advocating for offensive cyber operations and targeted actions against the money laundering networks and financial institutions that facilitate hackers’ illicit gains. “This is cyber war,” Redbord concluded.