Binance's $6.3B Hack Is 'Cyber War,' TRM Labs Policy Chief Says

The record $6.3 billion theft from Binance amounts to open "cyber war," and governments should respond with offensive hacking operations against North Korea, according to Ari Redbord, global head of policy and government affairs at blockchain intelligence firm TRM Labs. His comments to Cointelegraph came as the industry continued to digest the largest crypto exchange breach on record.

TRM Labs moved early to attribute the attack. The firm pinned it on the North Korean hacking group TraitorTrader, citing "indisputable" on-chain and off-chain evidence. The same group was behind the $1.5 billion hack of Bybit in February 2025.

Binance's own postmortem, published Nov. 3, described the intrusion path. Attackers posed as recruiters to plant malware on an engineer's work computer. They then used a compromised internal AI tool to reach the exchange's wallet-signing service.

How fast did the industry react?

The response broke records of its own. Tether froze 971.1 million USDt just 37 minutes after the main sweep of stolen funds. Across the board, stablecoin issuers froze roughly $2.67 billion in tokens, according to TRM's figures.

"Nothing like that has ever been done before," Redbord said. "They were able to claw back 40% right out the gate."

Speed matters because the race to immobilize stolen funds before hackers move them off-chain is the decisive phase of any recovery effort. Redbord credited the Beacon Network, an intelligence-sharing system TRM launched in 2025, with enabling that coordination. Companies used it to freeze funds quickly, then worked toward seizure.

"Normally I see a few Beacon alerts maybe every day. I've seen, I don't know, hundreds or maybe even a thousand Beacon alerts over the last few days," he said.

The coordination push has an awkward backdrop. Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit — which TRM formed with Tron and Tether in September 2024 — disbanded in late August. Sources cited slow responses and poor coordination. Tether said it would keep working with TRM through Beacon.

Why doesn't freezing funds deter the attackers?

Redbord was blunt: it doesn't, and the math explains why. North Korea's Oct. 29 theft equaled roughly a third of the country's GDP. It accounted for half of the $12.5 billion stolen by state-backed hackers since 2017. Even if attackers ultimately recover only $1 billion from the haul, the payoff remains enormous.

"North Korea will keep doing this as long as it's effective," he said.

He also warned that even the unprecedented industry response won't stop the pattern. "We are only going to see much more of this," he told Cointelegraph.

TRM's capacity gap report frames the structural problem. The gap between attackers and defenders keeps widening, driven largely by hackers' early adoption of frontier technologies such as AI. Redbord argued that law enforcement and compliance teams need AI of their own — to find and patch vulnerabilities as fast as attackers can exploit them.

What does Redbord want governments to do?

His prescription moves from defense to offense. He called for offensive cyber operations against North Korea, whose hackers operate as an arm of the state.

"Every time North Korea hacks, we should be hacking them back," he said.

He also urged action against the laundering networks and banks that let the regime cash out stolen funds, targeting the financial plumbing rather than just the thieves.

What does this change for exchanges and issuers? In practice, it raises the bar on readiness: frozen-asset response times measured in minutes, shared alert infrastructure like Beacon, and AI-assisted vulnerability scanning are becoming baseline expectations rather than best practices. Whether governments adopt the offensive posture Redbord describes — and whether the disbanded T3 unit's coordination gaps get fixed elsewhere — will shape how the next state-sponsored theft plays out.