A massive cyberattack on cryptocurrency exchange Binance, resulting in losses amounting to $6.3 billion, has underscored the sophisticated capabilities of state-sponsored hacking groups. Detailed investigations after the incident revealed that the attackers did not simply compromise the exchange’s infrastructure but also managed to infiltrate internal tools.
Modus Operandi and Initial Findings
In a comprehensive incident report dated November 3, Binance disclosed that the attackers masqueraded as a recruitment officer to install malware on an engineer’s work computer. Following the breach, an internal AI tool was compromised and utilized to access the wallet-signing service. TRM Labs, a blockchain intelligence firm, linked the attack early on to the North Korean-associated group known as TraitorTrader. This attribution is backed by both on-chain and off-chain data.
TRM Labs identified the attack as being linked to the North Korean TraitorTrader group, supported by substantial on-chain and off-chain evidence.
Asset Freezing and Industry Coordination
One of the most notable responses following the attack was the rapid freezing of stolen assets. Tether froze 971.1 million USDT tokens just 37 minutes after the main transfer event. According to TRM Labs, various stablecoin issuers collectively immobilized tokens valued at $2.67 billion.
Ari Redbord, the Head of Global Policy and Government Affairs at TRM Labs, noted that the joint industry response to this incident was unprecedented in scale. Redbord stated that about 40% of the funds were initially recuperated through these coordinated efforts.
Redbord highlighted that approximately 40% of the funds were recovered in the initial phase due to the sector’s concerted intervention, in an operation of scale never seen before.
Redbord emphasized the role of the Beacon Network system, which was activated in 2025, in facilitating rapid information sharing between companies. This infrastructure enabled entities to take synchronized actions to halt the movement of assets before the seizure process could occur.
Deterrence Debate Intensifies
However, Redbord warned that coordination alone might not suffice to prevent future attacks. He argued that the heist, dated October 29, represents a significant return for North Korea’s economy, with half of the $12.5 billion attributed to state-supported groups since 2017 connected to this event.
Bloomberg’s November 4 article revealed that the T3 Financial Crime Unit, established in collaboration with Tron and Tether, was dissolved by the end of August. Sources cited slow responses and weak coordination as key factors in this decision. Tether has confirmed that it continues to work with TRM through the Beacon network.
AI-driven Threats Highlighted
A capacity gap report from TRM Labs revealed a growing divide between attackers and defense teams. The firm attributes this mainly to hackers adopting new technologies like AI early. Redbord argues that enforcement and compliance teams require AI tools of similar sophistication to rapidly identify and address vulnerabilities as adeptly as the attackers do.
Redbord warned that North Korea would likely persist with similar cyber operations as long as they prove successful. He urged governments to go beyond defensive measures and take decisive action against money laundering networks and the banks facilitating funds for these cybercriminals.
