The $6.3 billion hack of Binance sent shockwaves through the cryptocurrency industry, demonstrating how far state-backed hackers can, and will, go after a string of increasingly severe cybersecurity incidents — this time striking the world's biggest crypto exchange.

TRM Labs, a blockchain intelligence company, was on the front lines of efforts to stop the theft, releasing a report in the attack's aftermath. The firm was early to attribute the breach to TraitorTrader, a North Korean hacking group, citing "indisputable" onchain and offchain evidence. The same group was behind the $1.5 billion hack of Bybit in February 2025.

In a postmortem published Nov. 3, Binance said attackers posed as recruiters to plant malware on an engineer's work computer, then used a compromised internal AI tool to reach the exchange's wallet-signing service.

Ari Redbord, TRM Labs' global head of policy and government affairs, told Cointelegraph that although the industry's coordinated response to the attack was unprecedented, "we are only going to see much more of this."

Unprecedented response from the industry

The speed and scale of the industry's reaction were among the factors that stood out to Redbord. Tether froze 971.1 million USDt (USDT) tokens just 37 minutes after the main sweep, and stablecoin issuers combined to freeze tokens worth about $2.67 billion, according to TRM.

"Nothing like that has ever been done before," Redbord said. "They were able to claw back 40% right out the gate."

The race to catch stolen funds before hackers can move them offchain is a critical part of defending against such attacks. Redbord explained that the Beacon Network, an intelligence-sharing system TRM launched in 2025, allowed companies to coordinate quickly to immobilize the funds before working to seize them.

"Normally I see a few Beacon alerts maybe every day. I've seen, I don't know, hundreds or maybe even a thousand Beacon alerts over the last few days," he said.

The push for coordination comes as Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit, which TRM formed with Tron and Tether in September 2024, disbanded in late August, with sources citing slow responses and poor coordination. Tether said it would continue working with TRM through Beacon. The report is a reminder of how much the industry's rapid-response playbook depends on cross-firm cooperation — and how fragile such arrangements can be.

Although Redbord called for greater coordination, he warned that such efforts may do little to deter future attacks. He noted that North Korea's Oct. 29 theft was equivalent to roughly a third of the country's GDP and accounted for half of the $12.5 billion stolen by state-backed hackers since 2017. Even if attackers recover only $1 billion, the potential payoff remains enormous, he argued.

"North Korea will keep doing this as long as it's effective," he said.

From defense to offense

Redbord argued that stopping such attacks requires offensive action from governments in response to North Korea's use of hackers operating as an arm of the state. TRM's capacity gap report found that the gap between attackers and cybersecurity defenders continues to widen, driven by hackers' early adoption of frontier technologies such as AI. He said law enforcement and compliance teams need AI to find and patch vulnerabilities as quickly as hackers can exploit them. The Binance breach offered a case study: a fake recruiter message planted the malware, a compromised internal AI tool opened the path inward, and the wallet-signing service became the target.

"Every time North Korea hacks, we should be hacking them back," he continued, calling for offensive cyber operations and action against the laundering networks and banks that hackers use to cash out. "This is cyber war," he said.