Binance hack is ‘cyber war,’ TRM Labs executive says

The $6.3 billion Binance hack sent shockwaves through the crypto industry. Following a series of increasingly severe cybersecurity incidents, the attack on the world’s biggest crypto exchange demonstrated how far state-backed hackers can, and will, go.

TRM Labs, a blockchain intelligence company, was on the front lines of efforts to stop the theft, releasing a report in its aftermath. The firm was early to attribute the attack to the North Korean hacking group, TraitorTrader, citing “indisputable” onchain and offchain evidence. The $1.5 billion hack of Bybit in February 2025 was attributed to the same group.

Binance said in its postmortem on Nov. 3 that attackers posed as recruiters to plant malware on an engineer’s work computer, then used a compromised internal AI tool to reach its wallet-signing service.