Binance hack is ‘cyber war,’ TRM Labs executive says

The $6.3 billion Binance hack sent shockwaves through the crypto industry. Following a series of increasingly severe cybersecurity incidents, the attack on the world’s biggest crypto exchange demonstrated how far state-backed hackers can, and will, go.

TRM Labs, a blockchain intelligence company, was on the front lines of efforts to stop the theft, releasing a report in its aftermath. The firm was early to attribute the attack to the North Korean hacking group, TraitorTrader, citing “indisputable” onchain and offchain evidence. The $1.5 billion hack of Bybit in February 2025 was attributed to the same group.

Binance said in its postmortem on Nov. 3 that attackers posed as recruiters to plant malware on an engineer’s work computer, then used a compromised internal AI tool to reach its wallet-signing service.

Ari Redbord, TRM Labs’ global head of policy and government affairs, told Cointelegraph that although the industry’s coordinated response to the attack was unprecedented, “we are only going to see much more of this.”

The speed and scale of industry’s response to the hack were among the factors that stood out to Redbord.

Tether froze 971.1 million USDt (USDT) tokens just 37 minutes after the main sweep. Combined, stablecoin issuers froze tokens worth about $2.67 billion, according to TRM. “Nothing like that has ever been done before,” Redbord said. “They were able to claw back 40% right out the gate.”

The race to catch stolen funds before hackers can move them offchain is a critical part of defending against such attacks. TRM’s Redbord explained that the Beacon Network, an intelligence-sharing system TRM launched in 2025, allowed companies to coordinate quickly to immobilize the funds before working to seize them. “Normally I see a few Beacon alerts maybe every day. I’ve seen, I don’t know, hundreds or maybe even a thousand Beacon alerts over the last few days,” he said.