Mentioned in This Article
1. What did TRM Labs say about the Binance theft?
Ari Redbord, global head of policy and government affairs at blockchain analytics firm TRM Labs, said on November 6 that the roughly $6.3 billion theft from Binance should be treated as a national security matter rather than an ordinary crime, describing it as "cyber war." He urged governments to move beyond sanctions and indictments and to take offensive action against the North Korean hackers believed to be responsible, the largest single crypto theft on record.
The argument rests on a simple reading of incentives. In Redbord's view, a state-backed group that can take billions of dollars in a single operation faces little cost for trying again, so defensive measures and after-the-fact asset freezes are unlikely to change its behavior on their own. He contended that the pressure has to land on the attackers and on the networks that turn stolen crypto into usable money.
His comments came in an interview a little more than a week after the theft, at a point when attribution had already largely settled. TRM was among the first firms to tie the operation to a North Korean group tracked as TraderTraitor, and it has said it based that view on strong onchain and offchain evidence.
2. How was the attack attributed to North Korea?
Attribution came quickly by the standards of past incidents. Blockchain intelligence firms linked the Binance theft to TraderTraitor within days of the October 29 drain, and the FBI publicly attributed the activity to the same North Korean group on October 31. Chainalysis reached the same conclusion as TRM, although the two firms quote slightly different totals for the amount taken, with TRM counting about $6.36 billion.
TraderTraitor is a name used by U.S. authorities and security researchers for a cluster of hackers working for the North Korean state. The group is known for patient social engineering, including approaches that pose as recruiters and offer attractive jobs to engineers at crypto firms, and for targeting the systems that sign and authorize large wallet transfers. Redbord also connected the group to the roughly $1.5 billion theft from the Bybit exchange in February 2025, which until now stood as the largest crypto hack ever recorded.
Binance, for its part, has pointed to a compromised device used by an engineer as the entry point, and has said it found no evidence that wallet private keys themselves leaked. The exchange has also said it will cover customer losses and has begun reimbursing users.
3. Why does Redbord call it a cyber war?
Redbord's phrase is a statement about scale and intent. When the proceeds of a theft are large enough to matter to a sanctioned government's finances, he argued, the activity stops resembling cybercrime and begins to resemble an operation of state. North Korea is widely understood by governments and researchers to use stolen digital assets to help fund its weapons programs, which is why Washington has treated these thefts as a sanctions and security issue for years.
That framing has practical consequences. Law enforcement tools built for criminal cases, such as indictments, seizures and forfeiture actions, move slowly and depend on suspects who can be reached. North Korean operators are largely beyond the reach of Western courts. Redbord's position is that policy tools must match the nature of the adversary, which in his words means governments should be willing to disrupt the hackers directly through offensive cyber operations.
He did not describe a specific operation, and he presented the idea as a policy direction rather than a plan. The broader point was that governments, exchanges and analytics firms have so far concentrated on tracing and freezing, and that this approach has not stopped the group from escalating from a $1.5 billion theft to one more than four times larger in under two years.
4. What have stablecoin freezes accomplished so far?
The response to the Binance theft showed how much faster the industry can move than it could even a few years ago. Stablecoin issuers including Tether, Circle, Ripple and World Liberty Financial froze balances linked to the attacker, and TRM counts about $2.67 billion frozen in total across issuers. Other trackers put the figure somewhat higher, and individual issuers have cited their own numbers, so the exact amount varies by source.
A freeze works because the major dollar stablecoins are issued by companies that can blacklist specific addresses, rendering the tokens held there unspendable. It cannot touch assets that have no issuer. Bitcoin and ether, for example, cannot be frozen by any company, and TRM has said the attacker still controls a large amount of both, which is why a meaningful share of the proceeds remains out of reach of issuers.
Redbord acknowledged that the freezes were a significant achievement and an example of cooperation across the industry. His caution was about deterrence: a group that expects to lose part of its haul but keep the rest may still regard the operation as highly profitable. In his assessment, North Korea will continue to attempt such thefts for as long as they remain effective.
5. Why are defenders struggling to keep pace?
Redbord also argued that attackers are adopting new technology faster than the institutions defending against them. He pointed to artificial intelligence as a tool that threat actors take up early, and said that law enforcement agencies and compliance teams will need to use the same technology to find and fix weaknesses at a comparable speed. TRM has published research describing a widening gap between the capabilities of attackers and defenders.
The Binance incident illustrates why that matters. Even a large exchange with substantial security spending was breached through the people and tools surrounding its signing infrastructure rather than through a flaw in a blockchain itself. That pattern, in which human targets and internal systems are the weak point, has recurred across the biggest crypto thefts, and it is difficult to address with technology alone.
For exchanges, the practical lesson Redbord drew was that speed of information sharing counts. Intelligence-sharing arrangements between analytics firms, issuers and exchanges allowed addresses to be flagged and frozen within hours in this case, and he argued that such coordination must be maintained and expanded even if it cannot by itself discourage the attackers.
6. What could governments do next?
Redbord's proposals fall into two categories. The first is direct action against the hackers, which he said should include offensive cyber operations. The second is pressure on the laundering infrastructure that converts stolen assets into cash, including the brokers, over-the-counter desks and banks that handle North Korean proceeds. Cutting off that conversion step, he suggested, would reduce the value of the theft to the state that commissions it.
Neither step has a scheduled decision point. No government has announced an offensive operation tied to the Binance theft, and any such action would likely be conducted out of public view. Sanctions designations and further law enforcement statements remain the more visible tools, and the next developments are likely to come from investigators tracking the movement of the funds that have not been frozen.
For the industry, the immediate questions are how much of the stolen amount can still be recovered, how exchanges revise the security of their signing and wallet systems, and whether regulators respond with new requirements. Redbord's remarks add a voice from the compliance and analytics side to the argument that the response to state-backed theft should be treated as a matter of national defense.
7. How do exchange hot wallets become targets?
Exchanges keep customer assets in a mix of storage types. Offline cold storage is slow to access but difficult to attack remotely, while hot wallets are connected to the internet so that withdrawals can be processed continuously. Because hot wallets must be able to sign transactions on demand, the software and employee devices around them form a natural target for any attacker willing to invest in a long, careful intrusion.
Social engineering is a common route into those systems. An attacker who convinces one employee to open a file or install a tool can gain a foothold on a corporate machine, and from there may try to reach internal services that approve transfers. Defenses typically include strict separation of duties, multi-party approval of large transfers, hardware-based signing and limits on what any single internal tool can request, though none of these measures is a guarantee.
This is why security specialists often describe the largest crypto thefts as operational failures rather than failures of cryptography. The underlying blockchains performed as designed in the Binance case; the point of compromise was the human and organizational layer around the keys.
8. Why can some stolen assets not be frozen?
The distinction between issuer-backed tokens and decentralized assets is central to every large theft investigation. A stablecoin issuer holds administrative control over its contract and can block an address on request from law enforcement or on its own initiative. That control is the reason the freezes after the Binance theft were possible at all, and why they were measured in billions of dollars.
Native assets such as bitcoin and ether have no such administrator. Once attackers hold them in addresses they control, the only options for investigators are to trace the funds, warn exchanges and brokers not to accept them, and wait for the thieves to try to convert them. Hackers therefore often swap frozen-prone stablecoins into assets that are harder to stop, which is the pattern investigators described here, and why Redbord focused on the cash-out networks at the end of the chain.