The $6.3 billion hack of Binance has sent shockwaves through the crypto industry, with TRM Labs attributing the attack to the North Korean hacking group TraitorTrader. The firm cited indisputable onchain and offchain evidence, noting that the same group was behind the $1.5 billion hack of Bybit in February 2025. Binance revealed that attackers posed as recruiters to plant malware on an engineer’s work computer, then used a compromised internal AI tool to access its wallet-signing service.
Ari Redbord, TRM Labs’ global head of policy and government affairs, highlighted the unprecedented industry response to the hack. Stablecoin issuers froze tokens worth about $2.67 billion, with Tether freezing 971.1 million USDt just 37 minutes after the main sweep. Redbord noted that the Beacon Network, an intelligence-sharing system launched by TRM in 2025, allowed companies to coordinate quickly to immobilize the funds.
Despite the coordinated response, Redbord warned that such efforts may do little to deter future attacks. He argued that North Korea’s Oct. 29 theft was equivalent to roughly a third of the country’s GDP and accounted for half of the $12.5 billion stolen by state-backed hackers since 2017. Redbord called for offensive action from governments, including hacking back and targeting laundering networks and banks used by hackers to cash out.
Redbord emphasized the need for law enforcement and compliance teams to adopt AI to find and patch vulnerabilities as quickly as hackers can exploit them. He stated, 'Every time North Korea hacks, we should be hacking them back,' framing the situation as a cyber war.