TRM Labs attributed an Oct. 29 theft from Binance to the North Korean hacking group TraitorTrader, citing what it called “indisputable” evidence. Binance said in a Nov. 3 postmortem that attackers posed as recruiters to plant malware on an engineer’s work computer, then used a compromised internal AI tool to reach its wallet-signing service.
TRM said stablecoin issuers froze tokens worth about $2.67 billion after the theft, including 971.1 million USDT frozen by Tether 37 minutes after the main sweep. Frozen tokens had not necessarily been seized. TRM executive Ari Redbord praised the coordinated response but warned that it may do little to deter future attacks.
