A $6.3 billion hack targeting Binance, the world’s largest cryptocurrency exchange, has drawn intense attention to the evolving scale of state-sponsored cyberattacks in the digital asset sector. The breach, which followed a succession of major incidents, underlined the growing sophistication of hackers and raised fresh questions about industry security.
Attribution to North Korean Group and Security Breach Tactics
Blockchain intelligence company TRM Labs led efforts to trace the origins of the attack. In its post-incident analysis, TRM Labs attributed the Binance hack to TraitorTrader, a North Korean state-linked hacking group, based on “indisputable” evidence collected onchain and offchain. The firm also linked the $1.5 billion Bybit hack in February 2025 to the same group.
Binance detailed that attackers infiltrated company systems by impersonating recruiters to deliver malware to an engineer’s computer. The malware later exploited a compromised internal artificial intelligence tool, which was then used to access the exchange’s wallet-signing service, enabling the theft.
TRM Labs, established as a leading provider of blockchain intelligence solutions, quickly mobilized forensic teams and worked closely with exchanges and law enforcement to coordinate the global response.
Mini dictionary: TraitorTrader is a hacking collective believed to be sponsored by North Korea, specializing in high-value cryptocurrency heists and frequently cited in blockchain security investigations for their targeted and persistent operations.
Rapid Response and Frozen Funds
Ari Redbord, TRM Labs’ global head of policy and government affairs, highlighted the unprecedented nature of the industry’s mobilization after the attack. Stablecoin issuers, led by Tether, responded by freezing significant amounts of stolen funds. Tether blocked 971.1 million USDT tokens just 37 minutes after the main sweep. Combined efforts by stablecoin issuers led to approximately $2.67 billion in frozen tokens, accounting for about 40% of the compromised assets within hours of the incident.
The breadth and speed of the stablecoin freeze was described as a first for the sector, immediately reclaiming a substantial portion of funds.
The industry’s push to intercept assets before they moved offchain was further aided by TRM Labs’ Beacon Network. Launched in 2025, this intelligence-sharing system allowed rapid communication between exchanges, companies, and compliance teams to immobilize stolen funds and coordinate follow-up recovery steps. Redbord described a dramatic increase in Beacon alerts, numbering in the hundreds or even reaching a thousand during the days after the breach.
Mini dictionary: The Beacon Network is a platform for real-time intelligence sharing among blockchain companies, exchanges, and compliance teams, providing rapid alerts about suspicious movements and coordinated defense against large-scale cryptocurrency theft.
| Response Entity | Action Taken | Amount Impacted | Timeframe |
|---|---|---|---|
| Tether | USDT Freeze | 971.1 million USDT | 37 minutes post-sweep |
| Stablecoin issuers | Total Freeze | $2.67 billion | Within hours |
Coordination Challenges and Ongoing Threats
Efforts to maintain coordinated industry defenses have faced obstacles. Bloomberg reported that the T3 Financial Crime Unit, formed in partnership with Tron and Tether in September 2024 under the guidance of TRM Labs, disbanded in late August 2025. Sources cited slow response times and poor coordination. However, Tether has continued working with TRM using the Beacon Network for information sharing.
Despite swift action, Redbord warned that such operations may not be enough to prevent future attacks. He cited that the $6.3 billion stolen by North Korean hackers on October 29 was equivalent to nearly a third of North Korea’s GDP and represented half of the $12.5 billion stolen by state-backed actors since 2017. He argued that even recovering a portion of these assets is highly lucrative for perpetrators and unlikely to deter future attempts.
North Korean groups are expected to persist as long as cyberattacks remain profitable, given the scale of financial gains relative to the country’s economy.
Call for Offensive Countermeasures and Future Outlook
Redbord maintained that stopping these cyberthreats will require not just defensive but also offensive strategies from international governments. He advocated for state-led counter-cyber operations targeting hacker infrastructure, laundering networks, and the banks used to facilitate illegal cashouts, framing the threat as an ongoing “cyber war.”
TRM Labs’ recent capacity gap report found that the divide between attackers and defenders is widening, as cybercriminals increasingly use advanced technologies such as artificial intelligence. Redbord urged law enforcement and compliance teams to adopt similar technologies in order to identify and address vulnerabilities at the same pace as adversaries.
“Every time North Korea hacks, we should be hacking them back,” he stated, emphasizing the need for active disruption of both hacking efforts and their financial infrastructure.
