TRM Labs expects Binance heist money to fund North Korean weapons proliferation

Probably a big chunk of the stolen Binance funds will be recovered

The money stolen from Binance is going to be used for weapons proliferation and other destabilizing activity, according to Ari Redbord, global head of policy at TRM Labs, a major crypto research firm. Redbord and other researchers said they are very confident that the North Korean state was behind the theft of more than $6 billion in cryptocurrency from Binance, the world’s biggest crypto exchange.

Researchers said the heist happened late in the afternoon, and that the entire thing took only about 20 minutes — 20 minutes for the bulk of the $6 billion to be stolen. Binance and the researchers are still trying to figure out exactly how it happened. But the gist, according to NPR’s reporting, is that the hackers effectively bypassed all kinds of security systems and hacked into the trading accounts that customers hold on the exchange. Those likely affected ranged from investment funds to everyday investors who trade digital currencies like Bitcoin.

“What happened last night is the largest bank robbery in human history,” Redbord said. “Imagine a world where someone could walk into a bank and walk out with $6.36 billion in stolen funds and then move those funds at the speed of the internet.”

Redbord said he is sure of North Korea’s involvement because the country has a history of cyberattacks and because the heist was really well planned and executed.

“North Korea has built the most sophisticated cyber capabilities in the world,” he said. “They have a cadre, teams of professional hackers who are part of their military. This isn’t just a commercial hacker who’s looking to make some money. This is going to be used for weapons proliferation and other destabilizing activity.”

That is what makes North Korean hackers so dangerous, NPR’s reporting said: researchers described them as very motivated and very organized.

Probably a big chunk of the money will be recovered, NPR senior business editor Rafael Nam said in an interview on the network. Binance has promised to fully pay back any customers who lost money in the heist — a group that includes big investment funds and a lot of mom-and-pop investors who trade on the exchanges. The company is working with other crypto exchanges and has been essentially able to freeze $3 billion that may have been stolen from Binance customers.

The traceability of cryptocurrency underpins the recovery effort, Nam explained: cryptocurrencies are kind of like dollar bills, which have serial numbers — if you have the number, you can try to find the money. Not all of it will be recoverable, he said, but Binance is trying. What remains is a bit of a cat-and-mouse game: the hackers are trying to move their stolen cryptocurrencies into their own accounts so they can gain full possession of them, and the researchers are racing to stop them from doing that.

Binance itself has a checkered history, according to the reporting. In 2023, the exchange pleaded guilty to violating anti-money-laundering laws and paid more than $4 billion in penalties.

Crypto exchanges are not regulated the way the New York Stock Exchange is, Nam noted. They exist in a gray regulatory area — one consequence is that the public does not know who is holding accounts at Binance, or who may ultimately have been affected by the theft.

Binance says it is working hard at recovering the funds and will make people whole. But Nam said the heist does reinforce concerns about the sector, reminding many critics of the crypto industry that it remains “a bit of a wild west.”