Binance hack called ‘cyber war’ as TRM urges action

The Binance hack is “cyber war,” TRM Labs policy chief Ari Redbord told Cointelegraph, calling for governments to take offensive action against North Korean hackers. The November 6 interview followed the theft of approximately $6.3 billion in token assets from Binance on October 29. The FBI attributed the theft to North Korea, which denies involvement.

• Binance said the incident occurred around 20:05 UTC on October 29 and involved approximately $6.3 billion in token assets.
• The FBI attributes the theft to North Korea and identifies the actors as TraderTraitor.
• TRM Labs estimated that about $6.36 billion left Binance wallets across ten blockchains.
• TRM said nearly $2.7 billion had been frozen by November 3, while about $2.4 billion remained in the attacker’s ETH and BTC holdings.
• Binance said it would cover losses through its SAFU fund and corporate treasury.

Timeline of the Binance hack

1. October 29, 2026: Binance said the security incident occurred at approximately 20:05 UTC. TRM Labs later estimated that roughly $6.36 billion left Binance wallets across ten blockchains.
2. October 30: Binance published a security update describing the incident and saying it would cover losses through its SAFU fund and corporate treasury. Read the Binance incident update.
3. November 3: Binance’s account, as reported by Cointelegraph, said attackers used a fake recruitment approach to place malware on an engineer’s work computer, then used a compromised internal AI tool to reach the wallet-signing service. The FBI attributed the theft to North Korea, which denied involvement. TRM also published a tracing update.
4. November 6: Cointelegraph published its interview with Redbord, who described the theft as “cyber war” and called for governments to take offensive action.

Background: how the Binance hack unfolded

Cointelegraph reported that Binance’s November 3 account described a fake recruitment approach used to place malware on an engineer’s work computer. The attackers then used a compromised internal AI tool to reach the wallet-signing service. The supplied account describes this sequence; it does not establish that the underlying blockchain itself was compromised.

The reporting identifies an employee’s work computer, an internal AI tool and the wallet-signing service as parts of the route used by the attackers. It does not provide further technical details about the tool or the signing service, so broader conclusions about AI security or Binance’s systems cannot be drawn from the available information.

Binance described the incident as involving approximately $6.3 billion in token assets. TRM’s separate estimate was about $6.36 billion leaving Binance wallets across ten blockchains. The two figures are close estimates reported at different levels of precision. Binance said it would cover losses through its SAFU fund and corporate treasury.

Reactions and market context

The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29. It urged crypto and blockchain-service providers to block transactions linked to addresses used by the actors it calls TraderTraitor. North Korea denied involvement on November 3. The Associated Press reported that Kim Yo Jong called the FBI’s attribution “a trite provocation” and “absurd rhetoric.”

Redbord told Cointelegraph that the potential payoff would keep North Korea stealing crypto. He said the Binance haul was roughly one-third of the country’s GDP and about half of the $12.5 billion stolen by state-backed hackers since 2017. These are Redbord’s assessments as reported in the interview, not independently verified measurements in the research provided.

TRM’s interview account said Tether froze 971.1 million USDT 37 minutes after the main sweep, while stablecoin issuers together froze about $2.67 billion. Redbord described the industry’s response as unprecedented. TRM’s November 3 tracing update said the main Ethereum and Bitcoin balances showed no new relevant activity as of that date, while funds were moving on TRON and Solana. These figures are a dated snapshot, not a final recovery total.

Market prices do not establish whether the incident affected the broader market. At 11:13 UTC on November 7, CoinGecko data showed BTC at $75,917, down 0.02% over 24 hours; ETH at $2,244.34, up 0.53%; and BNB at $694.25, up 0.05%. The Crypto Fear & Greed Index was 25, classified as Extreme Fear, on November 7, according to Alternative.me.

Outlook: what to watch next

Questions include whether investigators and service providers can trace or freeze additional funds, and whether further evidence supports or challenges the FBI’s attribution. TRM’s November 3 update reported movement on TRON and Solana and described the status of the main ETH and BTC balances as of that date. Those details are a dated account, not a statement about current balances.

Redbord’s call for offensive government action is a policy argument, not an announced response. The reported attack path may prompt crypto firms to examine employee-device security, recruitment checks and controls around AI tools and wallet-signing systems. The evidence provided does not establish what changes, if any, Binance or other firms have made in response.

FAQ

Who does the FBI blame for the Binance hack?

The FBI attributes the theft to North Korea and identifies the actors as TraderTraitor. North Korea denied involvement on November 3, as reported by the Associated Press.

How much of the stolen crypto was frozen?

TRM Labs said nearly $2.7 billion had been frozen by November 3. It estimated that about $2.4 billion remained in the attacker’s ETH and BTC holdings at that point. These are dated estimates.

What does Redbord mean by “cyber war”?

In his November 6 interview with Cointelegraph, the TRM Labs policy chief described the theft as “cyber war” and called for governments to take offensive action against North Korean hackers. That is Redbord’s characterization.

Sources

• Binance hack is ‘cyber war,’ TRM Labs executive says (cointelegraph.com)
• Security Incident Update #2 (2026-10-30) (www.binance.com)
• Binance hack is ‘cyber war,’ TRM Labs executive says (Cointelegraph)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.