TRM Labs

Like you said, Binance lost about $6.36 billion that was taken out of Binance Wallets due to a hack.

And all TRM Labs, who started with the lead, who led the digital forensic response was said that it happened in the space of about 20 minutes.

Yeah.

And I suppose the issue with it was obviously once they, you know, attributed, I think the FBI as well, attributed the attack to Trader Trader, which is the North Korean state unit for hacking.

Wow.

And who was this? So TRM Labs, we've had Jono on the show from them.

And Chain Alice, who does on-chain data analytics and analysis, have reported to the FBI that it looks like to be a North Korean state hacking unit tied to the Lazarus Group, who seem to be everywhere at the moment.

So I think this guy, we've reported on the Lazarus Group before and this one in particular called Trader Traitor.

The attacker's working wallet was funded through Tornado Cash, which is a mixer that hides where the money came from.

And then an organization called TRM Labs said prep started at least 36 hours before.

They were like doing dry runs of this.

Elliptic said that the attacker tested the code on two wallets and then rehearsed on a third about four hours before the real thing.

And the attack was widespread.

The blockchain intelligence company TRM Labs estimated that it affected wallets across 10 different blockchain networks.

and the hack was completed in under 20 minutes.

So to put that in perspective, the largest crypto hack we'd ever seen up to this point was in February 2025, when hackers nabbed around $1.5 billion from the Dubai-based exchange Bybit, which is smaller.

Experts have explained that freeze doesn't mean Binance has been or will be able to recover that currency.

It just means that hackers can't move it anymore.

We have an interview with Ari Redbord, who's the global head of policy at TRM Labs, the company I mentioned earlier that's trying to trace these stolen funds.

We can listen to that right now.

Binance founder Changpeng Zhao said on X that the company owns SpaceX shares worth more than $1 billion.

The bulk of the heist unfolded in around 20 minutes, beginning late on October 29th, and bore similarity to previous large attacks blamed on North Korea, according to an analysis firm's TRM Labs and Chainalysis.

TRM said that attackers were able to order Binance wallets to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the FBI attributed to North Korea.

TRM attributes the attack to North Korea Elite Hacking Unit, the firm said in an analysis posted on its website.

Crypto firm Ripple also froze roughly $200 million in funds, Yi said.

The incident adds to a string of crypto thefts.

Last year, hackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.

In September, BitGet said roughly $350 million in crypto had been stolen from its platform.

Cointelegraph reached out to the FBI for comment.

Last week, blockchain intelligence firm TRM Labs attributed the Binance hack to North Korea's trader Trator Group with high confidence citing on-chain and off-chain intelligence.

Other investigators, including chain analysis ZachXBT, also linked the theft to North Korean hackers.

So who knows? Honestly, we don't know who the hell is behind the Binance hack.

Exactly.

Analytics firm TRM Labs looked at the actual capital flow of these agents operating on the new X402 payment rails.

They found that, collectively, these million agents are moving a mere $5,000 to $11,000 a month.

In total.

Industry partners have frozen... roughly $3 billion in affected assets while customers await the reopening of withdrawals.

TRM Labs traced the first unauthorized transfers to around 8.05 p.m. UTC on Thursday with Binance wallets drained across multiple blockchains.

The attackers targeted hot wallets, which exchanges keep connected to the internet to process withdrawals.

Hmm.