TRM Labs Calls $6.3 Billion Binance Hack ‘Cyber Warfare,’ Says North Korean Attacks Will Continue

TRM Labs, the blockchain intelligence firm that analyzed the $6.3 billion Binance hack, said the attack amounted to cyber warfare and warned that the threat from North Korean hacking groups will persist.

Cointelegraph reported on Nov. 6 that Ari Redbord, TRM Labs’ global head of policy and government affairs, said the industry’s response to the attack was unprecedented, but similar incidents would become more common.

Binance said in a post-incident report released on Nov. 3 that the attackers posed as recruiters, planted malware on engineers’ work computers, and then used internal AI tools to gain access to a wallet-signing service. TRM Labs attributed the attack to TraitorTrader, a North Korean hacking group. The same group was also behind the $1.5 billion Bybit hack in February 2025.

The amount stolen in the Oct. 29 hack is equivalent to about one-third of North Korea’s gross domestic product. It also accounts for roughly half of the $12.5 billion stolen by state-backed hackers since 2017. Redbord said North Korea would keep using the tactic as long as it remained effective, adding that even recovering $100 million would provide enough incentive.

He also argued for offensive cyber operations targeting the money-laundering networks and banks hackers use to cash out. "Every time North Korea hacks, we should respond in kind," he said.