Binance Hack Called a “Cyber War” as TRM Labs Urges Offensive Action Against North Korea

The biggest theft in crypto history hit the world’s largest exchange, and the fallout is still spreading. Blockchain intelligence firm TRM Labs tied the attack to TraitorTrader, a North Korean hacking group that was also blamed for the $1.5 billion Bybit theft in February 2025. The firm says the onchain and offchain evidence leaves no room for doubt. Binance explained in its own review on Nov. 3 that attackers pretended to be recruiters, planted malware on an engineer’s work computer, and then used a compromised internal AI tool to reach the service that signs wallet transactions.

Stablecoin Freezes and the Beacon Network

A Response Without Precedent

Tether froze 971.1 million USDT only 37 minutes after the main sweep, and stablecoin issuers together locked about $2.67 billion, roughly 40% of the loot. TRM’s Beacon Network, a sharing system launched in 2025, let firms act together. Redbord normally sees a few alerts a day but counted hundreds, maybe a thousand, in just a few days. Meanwhile, Bloomberg reported that the T3 Financial Crime Unit, built by TRM, Tron and Tether in 2024, was shut down in late August over slow responses, though Tether will keep working with TRM through Beacon.

Why North Korea Keeps Attacking

Redbord warned that defense alone may not stop the pattern. The Oct. 29 theft equals about a third of North Korea’s GDP and half of the $12.5 billion state-backed hackers have stolen since 2017. Even a $1 billion take is a huge win, so he expects more attempts.

Calls for Offensive Cyber Operations

TRM’s capacity gap report shows attackers pulling ahead of defenders, helped by early use of AI. Redbord says investigators need AI to find and fix weaknesses as quickly as criminals exploit them. He wants governments to hack North Korea back each time, and to go after the laundering networks and banks used to cash out. In his words, this is cyber war.