Binance’s $6.3 billion hack puts North Korea-backed crypto theft back at the center of payments risk

The Binance breach was not just another exchange incident. According to TRM Labs, the attack showed how quickly state-backed actors can move from access to theft, and how much of the response now depends on stablecoin issuers, blockchain intelligence firms, and whoever can freeze funds fastest.

1. Binance said in its Nov. 3 postmortem that attackers posed as recruiters to place malware on an engineer’s work computer, then used a compromised internal AI tool to access its wallet-signing service. TRM Labs was early to attribute the attack to the North Korean hacking group TraitorTrader, citing “indisputable” onchain and offchain evidence.
2. The hack followed a $1.5 billion theft from Bybit in February 2025, which TRM Labs attributed to the same group. Ari Redbord, TRM Labs’ global head of policy and government affairs, told Cointelegraph that the coordinated industry response was unprecedented, but “we are only going to see much more of this.”
3. The immediate containment effort matters because stolen funds can still be immobilized before they move offchain. Tether froze 971.1 million USDt (USDT) just 37 minutes after the main sweep, and stablecoin issuers together froze tokens worth about $2.67 billion, according to TRM. Redbord said, “Nothing like that has ever been done before,” adding that the industry was able to claw back 40% right out of the gate.
4. TRM said its Beacon Network, an intelligence-sharing system launched in 2025, helped companies coordinate quickly to stop the funds from moving. Redbord said he had seen “hundreds or maybe even a thousand Beacon alerts” over the last few days, compared with only a few a day under normal conditions.
5. The policy backdrop is getting messier, not cleaner. Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit, formed by TRM, Tron and Tether in September 2024, disbanded in late August after sources cited slow responses and poor coordination. Tether said it would continue working with TRM through Beacon.

Redbord also pointed to the scale of the North Korea-linked thefts: he said the Oct. 29 theft was equivalent to roughly a third of the country’s GDP and accounted for half of the $12.5 billion stolen by state-backed hackers since 2017. His point was blunt: if the payoff stays this large, the attacks stay in the model. For PSPs, exchanges, and stablecoin issuers, the practical question is no longer whether a freeze-and-trace response exists, but how fast it can be executed when the next sweep starts.