TRM Labs says 40% of Binance hack funds frozen; further recovery hinges on tracing and legal action

Some 40% of the funds stolen in the Binance hack were frozen within about an hour, while recovery of the remaining assets depends on continued tracking and coordination between exchanges and law enforcement.

In an October 30 interview with Bankless, Ari Redbord of TRM Labs said Tether and Circle had frozen about $2.4 billion of what he described as a $6 billion theft. He argued that the speed of the response was a central finding alongside the scale of the losses.

Redbord said TRM Labs contacted customers and smaller exchanges that could be affected, while coordinating with Binance and participants in the Beacon Network, an information-sharing network. He said its participants account for about 85% of centralized cryptocurrency trading volume and include 100 law enforcement agencies worldwide.

The network distributes alerts as investigators identify addresses holding illicit proceeds, allowing exchanges to block funds and work with authorities on seizures, Redbord explained. He credited investigators, exchanges and stablecoin issuers for their respective roles rather than claiming the results for TRM Labs alone.

Stablecoin issuers have the ability to freeze assets or burn and reissue them, Redbord said. Recovering ether and Bitcoin becomes harder as funds spread across addresses and move through smaller exchanges or over-the-counter brokers for conversion into cash. He said recovery remained possible if investigators continued tracing funds and used legal procedures to intercept them at exchanges.

Legal authorities are essential to securing assets and returning stolen funds, he added. Exchanges and stablecoin issuers may need subpoenas, search warrants or seizure warrants, with civil forfeiture proceedings and court hearings potentially following. Private investigators can trace transactions but cannot compel exchanges to disclose underlying records.

Redbord withheld a firm conclusion on how the breach occurred. He said Binance’s account of an engineer’s computer being compromised to access code and private keys was consistent with the on-chain activity TRM Labs observed. He also described small Tornado Cash withdrawals at least 36 hours before the attack, followed by tests on two wallets and a rehearsal on a third before the attack code was installed on Binance’s hot wallet. He characterized those steps as evidence of deliberate preparation, while leaving the final explanation to further investigation.

Redbord attributed the attack to North Korea, citing the preparation pattern and address connections to other hacks. He argued that the potential use of stolen assets to support nuclear weapons ambitions and regional destabilization made the theft a global security issue. With attackers becoming more sophisticated and AI strengthening their operations, he emphasized combining blockchain tracing, industry cooperation and legal action.