Binance’s $6.3 Billion Hack Was Cyber Warfare, TRM Labs Says, Warning of More North Korean Attacks
Summary
- TRM Labs said Binance’s $6.3 billion hack amounted to “cyber warfare” and warned that the threat from North Korean hacking groups will continue.
- TRM Labs said the North Korean hacking group TraitorTrader was behind both the recent Binance attack and the $1.5 billion Bybit hack in February 2025.
- Redbord said the amount North Korea stole through hacking equals about one-third of the country’s GDP, that it will keep using the tactic as long as it remains effective, and that offensive cyber operations are needed.
Forecast Trend Report by Period
TRM Labs, the blockchain intelligence firm that analyzed Binance’s $6.3 billion hack, said the attack amounted to “cyber warfare” and warned that the threat from North Korean hacking groups will persist.
Cointelegraph reported on Nov. 6 that Ari Redbord, TRM Labs’ global head of policy and government affairs, said the industry’s response to the attack was unprecedented, but that such incidents will become more common.
Binance said in a post-incident report on Nov. 3 that the attackers posed as recruiters, planted malware on a work computer used by an engineer, and then accessed the wallet-signing service through an internal AI tool. TRM Labs attributed the attack to TraitorTrader, a North Korean hacking group. The same group was also behind the $1.5 billion Bybit hack in February 2025.
The amount stolen in the Oct. 29 hack is equal to about one-third of North Korea’s gross domestic product. It also accounts for half of the $12.5 billion stolen by state-backed hackers since 2017. Redbord said North Korea will keep using the tactic as long as it works, adding that even recovering $100 million would provide enough incentive.
He also called for offensive cyber operations, saying each North Korean hack should be met with a counter-hack. Those efforts should target laundering networks and the banks hackers use to cash out.
