TRM Labs ties $6.36 billion Binance theft to North Korea and urges offensive response

First reported 06 Nov, 23:35 UTCSource: Crypto BriefingLast editorial activity 06 Nov, 23:35 UTCWrite a comment ↓

Silhouette of an observatory dome against a dramatic starry night sky. — Illustrative photo.Photo by Gabriel Mihalcea on Pexels

Blockchain intelligence firm TRM Labs has attributed the theft of about $6.36 billion from Binance to North Korea, and one of its executives argues that governments should shift from defence to offensive cyber action. Crypto Briefing reported the account.

Funds leave Binance wallets quickly

According to TRM Labs, most of the stolen funds moved within a window of about 20 minutes that opened at 20:05 UTC. The firm said it reached its conclusion with high confidence, using intelligence gathered on the blockchain itself as well as from sources beyond it.

The outflows hit Binance wallets spread across ten separate blockchains. TRM Labs connected the operation to TraderTraitor, a hacking group inside the wider Lazarus network that it describes as North Korean. Binance is a cryptocurrency exchange and finance company headquartered in the United Arab Emirates.

Scale set against the Bybit hack

The reported sum would make this the largest recorded crypto theft, eclipsing the $1.5 billion Bybit hack of February 2025, which was likewise tied to TraderTraitor. The FBI corroborated TRM Labs' attribution shortly after the incident.

The crypto industry moved to freeze an estimated $2.7 to $3 billion in stablecoins and other assets linked to the theft. Binance said it would cover the losses from its own reserves, committing over $6.34 billion, and assured users their assets were safe. The exchange then started reopening withdrawals in phases.

Early account of the breach

Initial data pointed to a compromised laptop belonging to a DevOps engineer as the route in, although there was no evidence that private keys had been taken.

Case for offensive cyber operations

Ari Redbord, TRM Labs' global head of policy, called the situation a cyber war. He contends that defensive security alone will not suffice and that governments should act more assertively against the groups behind such attacks, a position the firm presents as a need for proactive measures in global cybersecurity strategy.

Open questions

Will the North Korean attribution be formally confirmed beyond TRM Labs and the reported FBI corroboration?
How much of the stolen value will ultimately be recovered through the freezes?