# Inside the $6 Billion Binance Hack | Ari Redbord *Author: David Hoffman* *Published: Oct 30, 2026* *Source: https://www.bankless.com/podcast/inside-the-6-billion-binance-hack* --- David Hoffman: [0:02] All right, Redbird, you are at TRM Labs. TRM Labs, you guys are just on the David Hoffman: [0:07] front lines of any big exchange hack. Let me start with this question here. The day of the Binance exchange hack, this was like a mythological day that never existed, only in our imaginations, but it's finally here. Was this expected? Was a Binance hack kind of expected in your possible futures, or were you surprised to see this? Ari Redbord: [0:28] Look, David, thank you for having me on in this crazy moment. If I look scruffier than usual, it's because I, as you indicated, sort of haven't slept all that much in the last 24 hours or so. Look, I think that as hackers have gotten more and more sophisticated, we're seeing higher and higher numbers. If you asked me, you know, a year or so ago, that there'd be a $1.5 billion hack on Bybit, I would have said, you know, that's crazy, right? Like we're talking about a billion dollars a year by North Korea at the most. And then it happened in one day. We've now seen North Korea steal about six, seven, eight billion in the last six years or so. And then we saw them steal six billion yesterday evening. So, I mean, the threat actors on the other side of these hacks are becoming more and more sophisticated. There's more money within the crypto ecosystem, which makes crypto a target for these types of cyber attacks. And I know we'll probably get to this later, but AI is really supercharging these types of operations. So am I surprised that there's a $6 million hack of Binance? I don't think I'm really surprised about much of anything right now in this ecosystem. David Hoffman: [1:35] The news broke about 12 hours, a little bit more than 12 hours ago. So like last evening, Eastern time, maybe 6, 7, 8 p.m. Eastern time. What have you been doing? Phyllis, put us in the life of Ari over David Hoffman: [1:48] the last like half of a day. Ari Redbord: [1:49] Yeah, no, it's a great question. And, you know, I'll tell you, I've seen the ecosystem come together in really extraordinary ways. And we'll get into the work of Tether and Circle, I'm sure, in all of this and really beyond. But I was really proud of what happened at TRM, right? I mean, immediately, the team started reaching out to our clients and customers, what smaller exchanges potentially could be impacted. Our partners reached out to our partners at Binance. We are a remote-first company, so we created a war room within Slack, where our blockchain intelligence team, where our global investigations team was coordinating, and then reaching out to our Beacon Network partners. The Beacon Network is the largest information sharing network within the crypto ecosystem. It accounts for about 85% of all centralized crypto volume, think Binance, Coinbase, Kraken, OKEx, Robinhood, Stripe, PayPal, and 100 global law enforcement agencies all coordinating for a night like last night. And really kind of being able to leverage those resources, allowing us to move really, really quickly. So I would say it was an all hands on deck, a true war room mentality where I also wanted to make sure that we were getting out information to the community as we could. So I was scrambling on the report we ultimately put out last night. My colleague, Nick Carlson, who is too humble to like when I say stuff like this, I think is the foremost expert in the world on North Korea and cryptocurrency. He was talking to everyone he possibly could internally, externally to really coordinate a lot of this effort. David Hoffman: [3:19] As a result of the effort that you, TRM, and the Beacon Network put in last night, is that why money was saved? Assets were frozen, user funds were recovered? David Hoffman: [3:29] Can you talk about what the actual positive results of all that were? Ari Redbord: [3:33] And I certainly wouldn't take credit for all or any of it. I think that what we did with Beacon is really bringing the community together. And essentially, the way Beacon works is as funds are moving in real time, law enforcement investigators, private investigators like ZachXBT and others are flagging illicit proceeds as they're moving in real time. And they send out an alert to this network. So the real work that is being done here is like we bring the community together, but it's these investigators who are flagging addresses and it's the exchanges who then are blocking them and working with law enforcement to seize back those funds. The two biggest players last night, again, outside of the Beacon Network, were certainly Circle and Tether. And what they did was absolutely extraordinary. You know, I think that like, to me, if there are two headlines on this attack, it's one, obviously, this is the largest bank robbery in human history, you know, by magnitudes. You know, I was in this Netflix documentary called The Biggest Heist Ever. That was 70 million at the time. Even, you know, 4.2 was recovered in, you know, in the Bitfinex case, right? This is... Bigger out the door than we could even imagine. So obviously, the number is really important. But to me, the response is really the story, right? Like, literally, Tether and Circle were able to freeze 40% of the stolen funds last night, about $2.4 billion within an hour or so of the hack. Ari Redbord: [4:57] That really shows the power and promise of what the crypto ecosystem is able to do from a compliance perspective, from a technology perspective, from an investigations perspective. So I think that the number of the hack is a huge story. But literally, I mean, more was recovered last night than any hack that has actually ever happened. But I think that's a really important story here too. David Hoffman: [5:16] I know this just happened. So we're on like hour 15, 16 of this. What's left to settle when you're off of this live stream and you go back to work? I believe you haven't slept, so I hope you get some rest in shortly. But like, what's left to do? I know like some, the ether is gone, like the Bitcoin is gone, like the permissionless immutable assets, those are just going to be hard to recover. So like what's left to do today and this weekend and next week? Ari Redbord: [5:42] So I hope you're not entirely right. I do think it's going to be really hard. It's always becomes harder and harder to recover in that sort of decentralized ecosystem where funds are starting to spread out, starting to move other places, where you're using smaller OTC brokers to off-ramp funds. To convert funds from crypto to cash. I can get into that in a moment. But the reality is that, you know, between the Beacon Network and just the way that law enforcement works with the exchange community today, I still believe that there's hope. I mean, just to give your listeners a sense. Ari Redbord: [6:14] As this attack happened, we're watching funds flow from Binance. And we put a bunch of graphs in our report last night that hopefully visualize this. But as you're seeing funds move, what we're doing is we're counting those funds, we're watching them go, we're labeling the addresses where those funds go, and we're watching every dollar move. So the hope is not just, hey, you know, obviously stablecoin issuers have these really unique capabilities to immediately freeze or what I call burn and then ultimately reissue that asset, right? You're able to actually pull those funds out of an illicit actor's wallet address and put them into an inaccessible wallet address. It's just extraordinary capability. But for all the other funds, the Ether, the Bitcoin, potentially Bitcoin as we see the laundering process move on, that becomes much harder. But not impossible. So as those bad actors are, well, as North Korea is trying to off-ramp those funds through exchanges, we need to use the Beacon Network. We need to just use legal process to try to block and ultimately seize back those funds. Because the problem here is, right, this recovery effort is absolutely extraordinary. Again, like hats off to Circle and Tether for what they did last night for this ecosystem. Ari Redbord: [7:24] But even with those funds out of play, it's still the largest hack ever by about 2x. I mean, so we're talking about a lot of money. And I guess the last point I'd make on this, and we can kind of get into to this to the extent it's interesting, is it's North Korea. And when we talk about a hack or hackers or cyber criminals. Ari Redbord: [7:44] They're gonna use the funds for a lot of different reasons. Some of it is just purely greed. You wanna make money, you wanna buy cars, you wanna buy yachts or whatever it ultimately is, the way Rosal Khan lived in the Bitfinex hack, right? When it's North Korea, we're talking about destabilization. We're talking about nuclear weapons ambition. We're talking about really destabilizing the Korean Peninsula and beyond. This is a country with, I think, estimates around a $20 billion economy. I mean, this is a banana republic by all accounts. They stole $6 billion last night. That's a third of their overall economy. I mean, just like let that sit there for a second. That is crazy. So when we're talking about North Korea, to me, it puts an entirely other angle on any type of theft like this. It becomes a global security issue. David Hoffman: [8:32] I know that when there's hacks of this size, we saw this with the Bybit hack. The FBI got involved immediately. What's been the engagement with law enforcement looks like? What role do they play when it comes to hacks like this? Ari Redbord: [8:46] Law enforcement plays a really critical role here. And look, I mean, I am a huge believer that between technology and community, you know, tracking and tracing plus building out that beacon network, type of collaboration, we can get a lot done, but we don't have legal process, right? So ultimately, an exchange or a stablecoin issuer is going to need a subpoena or a search warrant or a seizure warrant in order to actually take those funds. And the funds that we seize back, there's likely going to be a civil forfeiture process, which is going to require court proceedings. So that's when you really need a Department of Justice or a global prosecutor's office or law enforcement to really get involved. There are limitations, right? ZachXBT is the best in the world or one of the best in the world at tracking and tracing funds, but he can't serve that subpoena on the exchange to ultimately get those underlying records. And that's when you need that sort of real coordination. And that's what you're Ari Redbord: [9:38] seeing from law enforcement for sure. David Hoffman: [9:40] There's this conversation around EIP 7702 and how the actual hack was executed. I know you're not Binance, you're not inside of their internal operations, so you only have so much limited perspective here. But what can you say about how the hack actually was executed and how novel of an exploit that was? Ari Redbord: [9:57] Yeah, it's probably the one thing I would mostly stay away from here only because I know that Binance has come out with some information, which I'm tracking, which honestly, their narrative around, I believe, an engineer whose laptop or computer systems, was hacked in order to gain access, to those codes, those private keys. Is consistent with what we were seeing on chain, the way this sort of exploit happened and the way those funds ultimately left the platform. But I'd probably leave ultimately that to Binance and ultimately figure out what happened over the course of a few days. I mean, if you think through Drift and some of the other activity that we saw over the summer, there could be an extraordinary story here of social engineering and how they ultimately gained access. And we'll see how kind of all that played out. One thing I think that's really important and really how we attributed North Korea in the first place is, you know, ultimately, we saw cash withdrawals about 36 hours ahead of the attack, small tornado cash withdrawals. Sorry, small tornado cash withdrawals at least 36 hours ahead. The attack code was tested on two wallets, then rehearsed on a third with test funds routed back to the attacker, and only then installed on that Binance hot wallet. So what I think the story is going to ultimately tell is a long-term, very deliberate effort to plan, coordinate, and breach Binance's cybersecurity systems. David Hoffman: [11:21] This is how I understand when the Lazarus Group identifies a potential attack vector, they kind of set up a dummy exploit and then they exploit it live, like on chain, like they create a fake Binance wallet and then they see if they can actually do it live. Were you is it possible to see these things come ahead of time based off certain patterns of like oh there's a bunch of gas transactions coming out of tornado cash this is what you would expect to see in case of like some actual larger attack coming were there any signs that you could reveal ahead of time that this was coming Ari Redbord: [11:53] So you know obviously this is that staging and rehearsal pattern that's really become a signature for for north korea cyber actors and sure you know obviously these are things that we can see on chain, but the reality is, are they really standing out in a way that, you know, you see sort of this, it's, it's, it's, you know, analogies aren't always useful, but in, in this case, it's like, you know, is an individual acting a certain way that is indicative of, you know, causing a murder or a school shooting or, you know, like it's really easy to Monday morning quarterback what we should or shouldn't have seen. But I think the reality is, yeah, I mean, there's indicia on chain, but there's a lot of activity on chain and really hard to sort of see. But I think that's what we're seeing here. And in large part, you know, you asked me how my night was last night. Probably the most extraordinary moment was about 9, 9.30, maybe 10 o'clock. We were about to put out this report, basically kind of walking through the hack. And right before we did that, my colleague, Nick Carlson, former FBI analyst, again, foremost expert in the world on North Korea, says this was North, he says to me, this was North Korea. And we really started to go through the why. And part of it very much is that staging and rehearsal piece. But we're also connecting addresses that we've seen in other hacks, you know, Drift. In particular, there's a lot of the similar signatures from Bybit. But that, but your question is really getting to sort of how we started to really Ari Redbord: [13:15] identify and believe with pretty high degree of confidence that that North Korea was involved here. David Hoffman: [13:20] Does North Korea care about being identified? Like if they exploit something and they get the Bitcoin, the Ether, like the bare assets inside of their wallets, like we can't go do something because they have nuclear bombs. And so like, do they really care about covering their footsteps? Ari Redbord: [13:38] Not that much. And I think that's really what's different about North Korea when you look in, and part of how we have, I think, carved out signatures over the years for North Korea, right? You know, you think of a painting. I think people like Nick and Christian Chesky and others on our global investigations team, you know, they look at this as an art and they're watching how North Korea is operating and see these signatures. But yeah, part of their signature has always been, hey, we're going to steal as much money as we can, We don't really care if we lose some here or there. I mean, they lost a lot last night, but they also made off with arguably, well, what would in and of itself be the largest hack ever by two acts, right? So they care a lot less about, you know, getting caught because no one's going to jail. There's never going to be an extradition. There's likely not going to be a criminal prosecution of any kind. And this is bank robbery for them at the speed of the internet. So I think that's always been sort of a signature for them. It's like, we're going to steal as much as we can, move it as fast as we can, and try to convert it for weapons proliferation and destabilizing activity. Part of what I believe is that we have to make them care more. And, you know, I talked a lot about cyber letters of Mark and this idea of using, you know, the private sector to go after cyber actors. We talk a lot about offensive cyber. When I was a prosecutor myself and Nick, who I've mentioned several times when he was at the FBI and a colleague of mine, Zia Faruqi, who's now a federal judge and others, issued a Patriot Act subpoena on a Chinese bank for records in a North Korea money laundering case. Ari Redbord: [15:07] We need to put diplomatic pressure on China in order to act, right? That is still an important trading partner, an important partner for North Korea. So there are things we can do beyond hardened cybersecurity at cryptocurrency exchanges. There are offensive tools we can use. To me, if they're stealing $6 billion, we should do everything we can to ultimately steal it back. So I think to your question, they don't care because no one's going to jail. And it becomes very, very hard to ultimately seize those funds back. But I think there are pressure points that we could put on them that would make them care more. David Hoffman: [15:39] Yeah, it does feel very lame of us in the West on the United States side of things that like North Korea just hacks billions of dollars. And we're just like, well, it's North Korea. I can't do anything about it. How much more can we do? If you were in charge, if you were in the U.S. government and you were in charge of like, let's standing up like a cyber international police division, like what would you try and do? Ari Redbord: [16:06] Sure. Well, first of all, look, I am not in the national security space anymore. I'm not a senior government official. I was a prosecutor for many years and spent time at Treasury. So, but I do believe that our national security apparatus, our Department of War, our intelligence community are doing a lot of this work today. David Hoffman: [16:27] Right. I guess they're just not disclosing it to people like me. Ari Redbord: [16:30] Or me. But I believe we can, I always believe we can do more, especially in this space. And part of it is just that diplomatic pressure. And to me, like all roads lead to China. You know, one other piece to this, and we saw that in the Bybit hack, is that eventually North Korea turns these stolen funds over to professional money laundering networks. I think we talked about this a few months ago on the show, more generally. If we haven't seen that here, we're going to see that here, right? North Korea understands that, hey, we can sell these funds, you know, take a percentage and call it a day and let these Chinese organized crime groups try to use their network of OTC brokers and others to convert these funds to cash. We see cartels do the same thing. We see these transnational pig butchering networks do the same thing. So, but how do we put pressure on the Chinese government to put pressure on organized crime, right? So I think there are levers we can pull. I mentioned a Patriot X subpoena, offensive cyber. There are a lot of levers we can pull to really, really put pressure on this regime. But the reality is that, you know, this is not a Russia. This is not an Iran. This is not a China, right? This is essentially a banana Ari Redbord: [17:40] republic, an entirely rogue regime who has never really cared that much about consequences. David Hoffman: [17:47] What are the second order consequences do you think might be coming to the crypto industry? I know this isn't an FTX implosion where there was fraud, but nonetheless, when something of this magnitude happens, I'm kind of just worried about the blowback on the industry, the increased regulation pressure. I'm sure entities like the FBI are just not happy with crypto because as a result of crypto, North Korea keeps on ending up with billions of dollars. Ari Redbord: [18:13] You know, it's interesting. Yeah, it's a great question. And like, I think I've been asked that today and I've been trying to sort of think it through because I do think this is different, like you said, than an FTX or even a situation where you're seeing sanctions evasion at scale or some other type of activity that, you know, skeptics can sort of point to as a reason. I mean, when I think about the Genius Act, right, it essentially codifies exactly what happened yesterday evening. It envisions, through regulation and legislation, stablecoin issuers having to do compliance, to include freeze, seize, burn their native token when it's used for illicit purposes. This is an amazing example of that happening, the best ever. Sadly, there's also half of these funds you're not able to do that with. But the reality is, I think that this is like, to me, this is the compliance and law enforcement and national security provisions of genius at work. So I think that that's like an important lesson that I've been trying to hammer home because obviously everyone's focused on the hack and North Korea as they should be. But this is an amazing story to me for the industry, particularly around Tether and Circle and the amazing work they did. Ari Redbord: [19:24] I was heartened to see Coinbase come out last night very much in support of Binance. How can we help? I mean, these are two huge competitors that have fought it out over the years. But to come together in a moment like that for this community, I think says a lot about what we're building. Another important piece, I mentioned the Beacon Network, right? The Clarity Act, rest in peace, I guess, codifies the Beacon Network. There's an entire section on certifying networks that information sharing, interdiction, disruption. Ari Redbord: [19:53] So I think lawmakers for a long time have been thinking about, like, what do we do in reaction to this? You know, I spent time with a law enforcement agency this week who couldn't have been more bullish on the way they're able to track and trace the flow of funds in ways they never could before. Are quite frankly worried that somehow they will lose connectivity to this industry, or the industry will be hurt in some way where we'll lose the ability to use, you know, these capabilities to track and trace funds, a U.S. Federal law enforcement agency. So I say that to say that like, will there be blowback? Like, yes. And there should be from a cybersecurity perspective. Like, we really, really need best practices. You know, I think DeFi has really learned that. I know the DeFi Education Fund, I met with them recently are doing some really great work, you know, So in the wake of Kelp and Drift, I think this probably calls for, you know, maybe Binance is the right place given that they're the largest, you know, crypto business in the world by magnitudes to kind of bring together the community to harden cybersecurity. So I think it's really a mix of things. But honestly, I think a lot of what we need, we have. Ari Redbord: [21:01] We just got to stop these types of events from happening. David Hoffman: [21:04] One big concern that's kind of plaguing the crypto industry is that the rise of AI capacity to exploit vulnerabilities in software is as high as it's ever been and will only get higher from here. I don't know if this hack of Binance really is that same story. This seems, as you kind of alluded to, a little bit more of the classical Lazarus group strategy, which is social engineering of an internal Binance piece of hardware, a laptop with private keys on it. Is there an AI story here, or is this more of just the classical Lazarus exploit story? Ari Redbord: [21:38] We don't know yet, is the short answer to it. But I think the sort of longer answer is we have seen North Korea really lean into AI, both open and frontier models, in order to, you know, do some of that social engineering upfront. We've also seen them use it in that just pure sort of tech cyber space, the exploit space. So I think that one, we don't know. I've definitely not connected and our team is not necessarily connected AI to this specific hack. But I definitely think we've seen North Korea start to figure out how to use AI at scale. And obviously, that's like a huge focus for us at TRM. I think we spent some time in our last conversation on that. But what we're really trying to do now is use AI to combine on-chain and off-chain insights into sort of build a holistic picture of risk, which I think is very apropos here in that, we see all the on-chain activity, but now we're going to need to understand, hey, where are these funds going? Are these shell companies or these OTC brokers who's sort of moving these funds and kind of build out that entire picture. But I would say that like, that was a long wind of saying, I'm not sure. But if I had to, you know, if I had to bet, I believe it was probably used in some way, you know, here, if nothing else, to work sort of on the exploit piece. David Hoffman: [22:54] Maybe another way to say what you're saying is like, even if the answer is no, we should prepare as if the answer is yes. Ari Redbord: [23:00] 100%. I mean, like what we've seen over the last, right, September, October, is this just increasing spike in cyber activity. And, you know, if you ask me what keeps me up at night, it's that, right? It's, hey, if we saw 7,500 ransomware attacks last year, now we don't need humans. We don't need, you know, we don't need affiliates. We can have agentic affiliates. Why isn't that 75,000 or 7.5 million? And that's a civilization level threat. When North Korea has that level of capability to take down entire hospital systems, you know, entire, you know, giant exchanges. So I think that whether it was used or not, it's absolutely something that, I don't know, I will likely spend the rest of my career working on, Ari Redbord: [23:44] you know, to be sure. Yeah. David Hoffman: [23:45] What does the industry need to do in reaction to this? How should the industry adapt or change what we do, how we do it in order to mitigate future instances like this? Ari Redbord: [23:57] You know, look, I think it's an offense defense type of game here. And I think it's in part, we really, as a community from the smallest DeFi protocol up to the Binances of the world, really lean into cybersecurity. You know, look, like while we couldn't have recovered funds as fast from a bank, no one could steal, walk into a bank and steal $6 billion either. So I think that like, we got to figure out how do we really, really safeguard the funds that are on our platforms. And part of that is getting to the bottom of how exactly this happened. And I'm sure that will happen over the next few days. I think then it's this offensive piece, right? Like, hey, if this is a nation state actor, right? This is not a criminal per se, this is a criminal state. So we need to use every national security system. Ari Redbord: [24:43] Tool at our disposal. So sanctions, you know, potential indictments, offensive cyber activity, you know, the whole gamut of national security tools, as I said, you know, Patriot Act subpoenas, whatever it takes on the offensive side. And finally, I think the community is going to continue to come together. I think Beacon is a great example. It was, I was really proud is a hard word on a night like last night, but I was, I just stepped back for a moment and watched my team coming together. I mean, I joined TRM. We were eight people. We're about 500 today. And the company's grown over the last six years. And the team that I saw come together last night, people who just started, people like Nick who've been there forever, it was really heartening. And then I was simultaneously watching Tether do its thing and Circle do its thing and World Liberty, Ripple. It was just really extraordinary. And I think that's in large part what I'll remember from my night last night. I also ate way too much Halloween candy, so I'm going to blame North Korea for that as well. David Hoffman: [25:44] Stress eating some candy. Yes, definitely. I'm sure you can take a little bit of the edge off. Yeah. Ari, well, I'm glad we have you in crypto. I know it was a tough day. It's a tough day for the industry, kind of on the four-year anniversary of FTX, more or less. But there was nonetheless some silver lining, as you kind of described, with the teams and the people that we have in crypto, making sure that we can prevent stuff like this for happening in the future. I know it's been a very long night. Thank you for coming on and giving me some of the time of day to answer some of my questions. I'm sure the Bankless Nation is very appreciative of it. Ari Redbord: [26:16] David, thank you. And thanks to Bankless Nation. The important thing is really raising awareness in that last couple of questions around what we could do and big believer that we could do a lot and we could do it together. So thanks for having me on. David Hoffman: [26:27] All right. All right. Get some rest. Ari Redbord: [26:29] Yep. Thanks, buddy. --- *This article is brought to you by [NEAR](https://www.bankless.com/sponsor/near-1785257427?ref=podcast/inside-the-6-billion-binance-hack)*