Inside the $6 Billion Binance Hack | Ari Redbord

Ari Redbord described the Binance theft as roughly $6 billion and, even excluding frozen funds, about twice the size of the next-largest hack. He framed it as another $6 billion stolen by North Korea, on top of roughly $6 billion taken over the preceding six years. With North Korea’s economy estimated at about $20 billion, he said the theft was equivalent to roughly one-third of its size and could support destabilization and nuclear ambitions.

Redbord cited a staged operation: small withdrawals through Tornado Cash began at least 36 hours before the attack; code was tested on two wallets, rehearsed on a third with test funds, and then installed on the hot wallet. He said the staging resembles patterns associated with North Korean cyber actors, although it was difficult to distinguish from other activity before the attack. Attribution also drew on connections between addresses and other hacks, including Drift and Bybit. Redbord was not inside Binance and left the definitive breach account to the company; Binance’s statement that an engineer’s compromised computer provided access to codes or private keys was consistent with what he observed on-chain.

After the attack, TRM Labs opened a Slack war room, coordinated its investigations teams, and contacted clients, partners, and Binance. Redbord said Tether and Circle froze about 40% of the stolen funds—roughly $2.4 billion—within about an hour, calling the response a major story and saying more had been recovered than in any prior hack. But about half the funds could not be addressed through stablecoin-issuer measures, so the initial freezes did not resolve the recovery effort.

TRM tracks the funds as they move, labels destination addresses, and monitors subsequent activity. Its Beacon Network covers about 85% of centralized crypto volume and includes 100 law-enforcement agencies worldwide; participants can flag suspected illicit funds so exchanges can block them and coordinate with investigators. Redbord said recovery becomes harder when funds move through decentralized networks or smaller over-the-counter brokers, but tracing and intervention may still be possible through exchanges, Beacon, and legal process.

Exchanges and stablecoin issuers need legal process, such as a subpoena or warrant, to act on funds, and recovered assets may require civil-forfeiture proceedings. On-chain investigators such as ZachXBT can trace transactions but cannot subpoena exchanges for underlying records, making law-enforcement coordination essential. Redbord said North Korean actors may use professional laundering networks, potentially paying them a cut; he also pointed to Chinese organized-crime groups using OTC brokers and other networks to convert funds to cash. He argued that pressure could include diplomacy, sanctions, potential indictments, offensive cyber tools, and action against organized crime through the Chinese government, and said efforts should be made to steal stolen funds back.

Redbord described the industry response—including Tether and Circle’s freezes, Coinbase’s public offer of support to Binance, and coordination involving World Liberty and Ripple—as an example of crypto firms working together. He said the GENIUS Act envisions stablecoin issuers freezing, seizing, or burning tokens used for illicit purposes, while the Clarity Act codifies the Beacon Network’s information-sharing and interdiction approach. He expects some blowback but argued that stronger cybersecurity is needed, and suggested Binance could convene the industry. He said it is unknown whether AI played a role in this attack and that his team has not connected AI to it, though he would bet AI was used somehow. Citing North Korea’s use of AI for social engineering and technical exploits, he urged the industry to prepare as if AI were involved and warned that AI could multiply the 7,500 ransomware attacks he cited for last year to 75,000 or 7.5 million, with consequences for hospitals and major exchanges.