Blockchain intelligence firm TRM Labs has attributed the $6.3 billion theft from Binance to a North Korean state-linked hacking group and warned that the campaign amounts to "cyber war," even as stablecoin issuers managed to freeze roughly 40% of the stolen assets within hours.
The exchange disclosed in a post-incident report on Nov. 3 that intruders posed as recruiters to plant malware on an engineer's work computer, then leveraged a compromised internal artificial intelligence tool to reach the wallet-signing service that ultimately let them drain funds. TRM Labs identified the perpetrators as TraitorTrader, a collective it says operates on behalf of Pyongyang, citing what it described as "indisputable" evidence gathered both onchain and offchain. The same group was previously tied to the $1.5 billion Bybit breach in February 2025.
"The industry's response to this attack was unprecedented, but we are only going to see much more of this," Ari Redbord, TRM Labs' global head of policy and government affairs, said in remarks to Cointelegraph. He described the coordinated freeze as a first for the sector: "Nothing like that has ever been done before. They were able to claw back 40% right out the gate."
Tether blocked 971.1 million USDT tokens just 37 minutes after the main sweep, according to TRM Labs. Combined action by stablecoin issuers immobilized about $2.67 billion of the compromised assets within hours.
Note: Figures as reported by TRM Labs.
Much of the speed came from TRM's Beacon Network, an intelligence-sharing system launched in 2025 that lets exchanges, blockchain companies and compliance teams alert one another in real time. Redbord said the volume of alerts during the days after the breach was far beyond normal, running into the hundreds or possibly a thousand, compared with a handful on a typical day.
The coordination effort has not been seamless. Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit, which TRM formed with Tron and Tether in September 2024, disbanded in late August, with people familiar citing slow responses and poor coordination. Tether said it would keep working with TRM through the Beacon Network.
Redbord argued that even a rapid defensive response may do little to discourage further attacks, given the payoff. He said the Oct. 29 haul equals roughly a third of North Korea's gross domestic product and accounts for about half of the $12.5 billion that state-backed hackers have stolen since 2017. Even recovering only a fraction of that, he said, leaves ample incentive.
"North Korea will keep doing this as long as it's effective," he said, adding that a $100 million recovery would still be enough to justify the operation.
He called for governments to move beyond defense, urging offensive cyber operations aimed at hacker infrastructure, money-laundering networks and the banks used to convert stolen crypto into cash. "Every time North Korea hacks, we should be hacking them back," he said. "This is cyber war."
TRM's capacity gap report found that the distance between attackers and defenders is widening as criminal groups adopt frontier technologies such as artificial intelligence early. Redbord said law enforcement and compliance teams need comparable tools to find and patch vulnerabilities at the same pace adversaries exploit them.
For the crypto industry, the episode sharpens scrutiny of operational security at the largest venues and of the role stablecoin issuers play as a de facto emergency brake on stolen funds. It also puts pressure on exchanges to share threat intelligence faster, and on policymakers to weigh offensive countermeasures that could escalate state-level conflict in cyberspace. The size of the loss, roughly a third of North Korea's annual economic output in a single operation, suggests that for as long as the strategy pays, attacks on digital-asset platforms are likely to continue.
