TRM Labs calls for offensive action against North Korean hackers after $6.36 billion Binance theft - Cryptonews.net

The operation moved the bulk of the funds within a 20-minute window that opened at 20:05 UTC.

TRM Labs linked the attack to TraderTraitor, a North Korean hacking group within the Lazarus network, with high confidence.

The FBI corroborated this attribution shortly after the incident.

The scale of the theft, $6.36 billion, dwarfs the previous record, the $1.5 billion Bybit hack of February 2025, which was also tied to TraderTraitor.

Industry response and exchange pledge

The crypto industry moved quickly to limit the damage, coordinating to freeze an estimated $2.7 to $3 billion worth of stablecoins and other assets tied to the theft.

Binance pledged to absorb the losses, committing over $6.34 billion from its own reserves to cover the incident and assuring users that their assets remained safe.

The exchange then began a phased resumption of withdrawals.

Initial information pointed to a compromised laptop belonging to a DevOps engineer as the likely entry point for the breach, though there was no evidence that private keys were exfiltrated.

A call for offensive cyber action

TRM Labs executive Ari Redbord described the situation as a 'cyber war' and argued that defensive security alone is insufficient.

Redbord’s reasoning rests on the significant rewards these state-sponsored attacks generate, which means the attackers have every reason to continue despite high security walls.

The recurring theme across these incidents is the human layer, as exchanges can harden smart contracts and multisig setups, but an employee’s device remains a door that attackers keep finding unlocked.

Implications for security and policy

For exchanges, the clearest lesson is operational, as the initial reporting about a DevOps engineer’s compromised laptop suggests the industry’s biggest security gap sits in workstation hygiene, access controls, and internal permissions rather than in on-chain code.

For users, Binance’s commitment of over $6.34 billion from reserves is the key number.

The successful locking of an estimated $2.7 to $3 billion in stablecoins strengthens the case that issuer controls are a meaningful defense.

Redbord’s call for offense moves the conversation from compliance departments to national security agencies, reframing crypto theft as a geopolitical problem rather than purely a corporate security one.