TRM Labs linked the operation to TraderTraitor, a North Korean hacking group that sits within the broader Lazarus network. The firm said it reached that conclusion with high confidence, drawing on intelligence gathered both on-chain and off-chain.
The FBI corroborated TRM Labs’ attribution shortly after the incident.
The scale puts the event in a category of its own. It is the largest recorded theft in crypto, and it dwarfs the $1.5 billion Bybit hack of February 2025, which was also tied to TraderTraitor.
The industry hits the brakes, and Binance opens its wallet
The response came fast. The crypto industry coordinated to freeze an estimated $2.7 to $3 billion worth of stablecoins and other assets tied to the theft.
Binance, for its part, pledged to absorb the losses. The exchange committed over $6.34 billion from its own reserves to cover the incident and told users their assets remained safe.
The exchange then began a phased resumption of withdrawals.
Early information pointed to a familiar weak spot. Initial data suggested that a compromised laptop belonging to a DevOps engineer enabled the breach, though there was no evidence that private keys were exfiltrated.
Redbord’s case for going on offense
Ari Redbord, TRM Labs’ global head of policy, did not mince words about what the theft represents. He described the situation as a “cyber war.”
His argument is that defensive security on its own will not be enough. Redbord urged governments to escalate offensive cyber operations against North Korean hacking programs.
The reasoning rests on incentives. Redbord pointed to the significant rewards these state-sponsored attacks generate, which means the attackers have every reason to keep trying no matter how high the walls get.
A pattern of escalation
Bybit was the benchmark until now. Its $1.5 billion loss in February 2025 was considered a watershed moment for exchange security, and it was linked to the same North Korean group.
The recurring theme across these incidents is the human layer. Exchanges can harden smart contracts and multisig setups, but an employee’s device remains a door that attackers keep finding unlocked.
What this means for exchanges, users and policymakers
For exchanges, the clearest lesson is operational. If initial reporting about a DevOps engineer’s compromised laptop holds up, the industry’s biggest security gap sits in workstation hygiene, access controls and internal permissions rather than in on-chain code.
For users, Binance’s commitment of over $6.34 billion from reserves is the key number.
The stablecoin freeze will also shape the policy debate. Successfully locking an estimated $2.7 to $3 billion strengthens the case that issuer controls are a meaningful defense.
Then there is Redbord’s call for offense, which moves the conversation from compliance departments to national security agencies. The argument reframes crypto theft as a geopolitical problem rather than purely a corporate security one.
cryptobriefing.com
