Inside the $6.36B Binance Hack with Nick Carlsen

Ari Redbord (00:00):

I'm Ari Redbord, and this is TRM Talks. I'm Global Head of Policy at TRM Labs. TRM is an AI investigations and threat intelligence company combining on-chain and off-chain data to combat modern crime and build a safer world. We use our AI investigations platform, Ardence, along with Chainabuse and the Beacon Network to bring together the public and private sectors to defeat scam networks, ransomware gangs, terrorist financiers, and other threats.

(00:35):

Prior to joining TRM, I spent 15 years in the US federal government, first as a prosecutor at the Department of Justice and then as a US Treasury Department official, where I worked to safeguard the financial system against terrorist financiers, weapons of mass destruction proliferators, drug kingpins, and other rogue actors.

(00:56):

On TRM Talks, I sit down with business leaders, policymakers, investigators, and friends from across the blockchain, AI, and technology space who are working to build a safer world. On today's TRM Talks, I am joined by friend, TRM global investigator, and former FBI analyst, Nick Carlsen, for a discussion on the Binance hack. But first, Inside the Lab, where I share data-driven insights from our blockchain intelligence team.

(01:30):

Today on TRM Talks, we talk about the record $6.36 billion Binance hack. But first, let's put the hack in perspective. North Korea has now stolen about $12.8 billion in cryptocurrency. $7.4 billion of it came just this year. Back in 2020, North Korea was behind 7% of all the value hacked worldwide. This year, that number is 85%.

(01:59):

Even if you leave out the Binance hack, North Korea is still responsible for about 45% of all stolen cryptocurrency. Now, Binance. About $6.36 billion was stolen from Binance in about 20 minutes. Compared to the Binance hack, the largest hack on record was the $1.5 billion Bybit hack in February 2025. Binance is four times that number.

(02:26):

So how did they do it? North Korea doesn't attack code. In fact, smart contract attacks account for only about 1%. They go after people. A fake recruiter sends someone a coding test. The test has malware in it that gets them keys, cloud tokens, then the systems that sign transactions. Count in Binance, and 88% of what North Korea has stolen comes from attacks just like that.

(02:57):

Then they move the money fast using mixers, cross-chain swaps, and over-the-counter brokers. It is a race to the off-ramps. In this case, we saw some success. Circle and Tether froze about 2.4 billion in stablecoins within the first 37 minutes of the attack, and the Beacon Network continues to coordinate, trace, track, block, and work with law enforcement to seize transactions.

(03:24):

There's a lot of work to be done, and today we're gonna talk about how the hack happened and what it means for the crypto ecosystem. And now, Nick Carlsen.

(03:35):

Today I am with friend and TRM investigator, former FBI analyst, foremost expert in the world on North Korea, I know he doesn't like when I say stuff like that because he is very humble, Nick, thanks for coming back on TRM Talks.

Nick Carlsen (03:50):

Yeah, Ari, thanks for having me back.

Ari Redbord (03:52):

Let's get right into it.

(03:53):

We're talking today about the Binance hack, the largest bank heist in human history, the largest crypto theft, $6.36 billion. You were the first to attribute it to North Korea. But talk me through Thursday. When did you start to sort of see things that were off to you?

Nick Carlsen (04:13):

Yeah. So it actually goes back a couple days before. You know, we saw something a little concerning, thought there might be something in the works on the North Korean side. We were scrambling trying to figure out what was going on. And then on the 29th, I took a break. I went to pick up my kids at the bus stop, went to the grocery store, looked at my phone, got a message from Tay Monahan.

(04:34):

Folks who follow this stuff know her. And looked like Binance had some huge outflows. So kind of heart dropped, raced back home, got on the computer, started looking, and yeah, the race was on basically to figure out who it was. But it was definitely a hack. And as we dug into it, you know, we had a few indicators we were able to pull together.

(04:56):

Jonti at Pangolin Intelligence in Singapore, a huge help. And using that combined intelligence from both of us, from TRM and from Jonti, we were able to really confidently pin this on North Korea within a couple hours.

Ari Redbord (05:10):

Even backing up sort of slightly, you mentioned picking your kids up at the bus stop. I do also remember this. This was like 2:00, 3:00-ish in the afternoon. What did you see, like, over the course of the next few hours? Not just that you attributed to North Korea, but what were you seeing on the platform on chain?

Nick Carlsen (05:25):

Yeah. So, you know, it's always a mad dash, right, to try to figure out who did something. And so the first question that you always have is, well, where did any pre-funding come from? Because, you know, if the North Koreans are gonna send out a bunch of stablecoins to a new address, they need gas to move it.

(05:41):

And so we backpedaled, backtraced from that Ethereum address that received most of the stolen funds and, you know, hit Tornado Cash. And then we tried to back through that, and we did, and found some ancient activity all the way back to 2020. And from there, you know, found those little clues and pinned it on the North Koreans.

(06:05):

That was the big race.

Ari Redbord (06:07):

And I'm gonna get back to the hack in a moment, but when you talk about the North Koreans, specifically TraderTraitor, which is sort of an FBI term, as you've explained it to me, for this group, essentially North Korea's premier hacking unit. Talk me through a little bit about TraderTraitor.

Nick Carlsen (06:22):

Yeah, I mean, these guys are the tip of the spear. North Korea's got this huge cyber army, right? And it goes all the way from the, like, the bottom of the pyramid is IT workers. Then you have pray-and-spray attack groups like Contagious Interview. You got Squid Squad, the guys who do the fake broken Teams link calls, and then you have TraderTraitor.

(06:42):

And there's kind of this interesting overlap in the TTPs where TraderTraitor's bread and butter is fake job interviews, right? Getting an engineer, doing a bunch of research, finding the right guys at a company, setting up an interview, getting them to run some malware, execute some code on a work computer, which totally overlaps with the bottom-tier guys, the Contagious Interview.

(07:02):

But the real distinction basically happens after the infection occurs, and TraderTraitor, as you see from Binance's own statements, they were in this network for weeks, doing the reconnaissance they needed to figure out exactly how to manipulate Binance's systems in order to execute these transactions.

(07:19):

So they're the best of the best, basically.

Ari Redbord (07:21):

Talk me through that a little bit. Obviously, you mentioned the sort of really sophisticated social engineering attacks from TraderTraitor, where they are identifying and then targeting engineers, developers. At least according to Binance, what happened here?

Nick Carlsen (07:33):

Yeah. So Binance pointed to a couple of compromises, one back in June and one later, I think in September. It seems like the September one was the proximate cause of this. And you know, I need to better go consume the details of that. But essentially, this guy was tricked into an interview, shockingly, but very commonly in this situation, he did it on his own work computer for his current employer, which is Binance.

(07:56):

And that gave them a toehold, basically. That lets the North Koreans in on just a little bit of Binance's infrastructure. But once you're behind the wall, you have a lot of latitude to move left and right. And these guys do incredible preparation for this. You know, they basically already have a human network map for their target.

(08:13):

They know who they need to go after and the specific subsystems that they need to go after. And a lot of this, you know, is probably, you know, this is speculation, but it's gained from the knowledge that other IT work teams have, right? When North Koreans gain access and employment at similar companies and businesses, they start to understand the topology of how exchanges handle their assets, right?

(08:35):

And how they have security in place to control outbound transactions. So they gather this huge amount of targeting information, and then they apply that in practice, and they do it patiently. You know, they wait weeks and weeks and weeks, until they find that perfect moment.

Ari Redbord (08:52):

TRM put out a report to try to put all of this in context a couple days ago, on sort of just overall cyber activity, crypto hacks coming out of North Korea. We put over 7 billion this year. Obviously, the 6.3 is a huge piece of that from Binance. 12.5 billion since 2017. I mean, this is a country with a GDP of around 20 billion, right?

(09:16):

They stole a third of that on Thursday. You have deep perspective. You've been working on this stuff, I think we were on another thing today where you said since you were 17. I mean, this has been your life's work. I love the fact that you came to TRM because it was a place that you could really focus on it in the way that you have.

(09:30):

But just how has North Korea, essentially a banana republic, one of the poorest countries in the world, been able to build a unit like TraderTraitor?

Nick Carlsen (09:39):

Yeah, I mean, a key point, banana dictatorship. They're not even a republic.

Ari Redbord (09:43):

Yeah. Yeah. Yes, sir. Yeah.

Nick Carlsen (09:45):

Yeah, no, I mean, it's kinda crazy. The story goes all the way back to the 1990s. Kim Jong Il repeatedly, you know, made statements, comments, built units about providing, you know, North Korea would be a leading IT services provider.

(09:59):

That was kind of their vision back in the '90s and early 2000s. And I recall reading that stuff and thinking, "What a joke," you know. "This is ridiculous. These guys have nothing to offer the world, in this respect," and the joke's on me, because here we are, right, 20-plus years later, and they're doing what they're doing.

(10:16):

But yeah, that evolution from, you know, being licit service providers, helping companies, you know, on the up and up to being this kind of premier hacking army, I mean, it really gets going in the early 2010s, when North Korea did a couple of defacement attacks on South Korean media and government companies.

(10:39):

And then you had the Sony hack, right, about "The Interview" movie, where they, you know, basically because of the insults to Kim Jong Un, took down a major motion picture studio.

Ari Redbord (10:49):

It was interesting, you know, I think about all these sort of early exploits, and the Sony Pictures one was another example where they were inside the systems for days, weeks, months maybe, right, before actually deploying malware. Which I thought was kind of interesting. When I heard about this from Binance, I thought that was just sort of interesting, even though it's not stealing funds—

Nick Carlsen (11:09):

Yeah. Well, and that's—

Ari Redbord (11:10):

Even similar typologies going back then.

Nick Carlsen (11:12):

Yeah, I mean, I think there was some switch that flipped, you know, circa 2014, 2015. I think number one, Sony was such a resounding success for the North Koreans, right? They cowed not only Sony Pictures, but the United States government. We did not back up, right?

(11:28):

We did not dismiss their threats, because remember, there were threats of actual physical violence in the United States. And they won. And so I think that just emboldened them. They saw that, look, we can do this to basically whoever we want. Why not do this to make money? There must have been some kind of conclave of the leadership that happened back then.

(11:46):

Because then you have, yeah, this like string— and the, you know, the really spectacular, I think eye-catching moment that everybody saw was the Bangladesh heist in 2016, where they stole, you know, over a billion dollars from a real bank. But yeah, the dawn, the rise of crypto, that was just this, you know, moment born for—

Ari Redbord (12:05):

Storm of North Korea getting really good at this—

Nick Carlsen (12:08):

Right when they needed it.

Ari Redbord (12:10):

All of a sudden you have cryptocurrency where you are not just stealing usernames and passwords anymore, but you can actually steal money that can be used to off-ramp it, and you can buy stuff. That is this perfect storm.

Nick Carlsen (12:23):

Yeah, totally. Right. For the North Koreans, you know, it's really important to put this all in the broader context because this is not happening in a vacuum, right? 2015, 2016, 2017, that's the peak of the work you and I were doing, right? Of trying to choke off North Korea's illicit financial networks because they were funneling billions of dollars of, you know, illicit revenue through US banks at that time, and we did a really good job.

(12:45):

You know, we shut down these massive networks run by Chinese companies like Dandong Hongxiang and Dandong Zhichuang, Foreign Trade Bank, and Korea Kwangsung Bank. You know, we really, I think, gave them a bloody nose, and it just so happens, right, that as that's going down and as the UN is ramping up sanctions, the rise of the digital currency industry gave them this basically off-ramp, right?

(13:07):

They were able to take that opportunity, steal these assets, and replace a lot of lost revenue with cryptocurrency. And why they don't hack banks anymore, you know, it's not because banks are more secure than crypto companies. In fact, I'm sure a lot of banks, especially local banks in the United States, are deeply vulnerable.

(13:27):

It's just that it is easier right now to convert digital currencies, cryptos into usable assets for them—

Ari Redbord (13:35):

And you can't recall a crypto transaction.

Nick Carlsen (13:38):

It is the advantages of crypto, right?

Ari Redbord (13:39):

Exactly. The promise of this technology is exactly what North Korea is exploiting. I mean, when I think about a bank heist, I think about, well, you can steal a billion dollars from Bank of Bangladesh, but they can also reverse the transaction, which they in part did in that case. You just can't do that here.

Nick Carlsen (13:53):

It is the unacceptable latency, basically. Anybody who has ever done a massive transaction through a correspondent bank, you are talking two to three days sometimes for it to get all figured out. That is what saves it, right? It creates the opportunity to pull this stuff back. And so the promise of crypto is we can do this quickly and cheaply.

Ari Redbord (14:09):

Every crypto bro, Bitcoin solves this. That is what it solves—

Nick Carlsen (14:14):

Like the fundamental irony of the whole thing. Totally.

Ari Redbord (14:17):

We were talking recently, and I think that there is this conventional wisdom that part of how North Korea built this capability is through identifying young people, putting them in special schools, giving them access to the internet. What is your view of just the overall narrative of how they built this capability?

Nick Carlsen (14:35):

Yeah, no, I mean, I'm robbing your commentary here, but it's like the East Germans in the '80s and the way that they dominated so many sports is, yeah, when you basically cultivate this talent from a young age and you control its outcome, right? In the United States, even in China, a smart guy can go and work in whatever industry he wants, do whatever he wants.

(14:54):

In North Korea, they all get funneled into this. So the best and the brightest in North Korea, which should be a prosperous, you know, contributing nation, gets funneled into criminality. And it's, to me, like the fundamental tragedy of this is that these people, these brilliant people who should be helping their own country are out here basically being the world's best gangsters.

Ari Redbord (15:15):

Back to the hack itself. We went through the mechanics of the hack, and honestly, Binance does a great job in their postmortem. I'm sure there's probably even more to come, so I'll mostly defer to them on what happened there. But you start to see funds move. And I can tell you, it was scary and inspiring for me at the same time. I literally saw TRM stand up this virtual war room. We are immediately in touch with our customers, many of whom are Beacon Network members on, "All right, this is what we're seeing happening. This is how we're going to coordinate."

(15:49):

I'm in the Beacon alert Slack channel at TRM, and I've seen, I don't know, hundreds a day pop up, whereas last week I was seeing a couple a day. So I think it's been really extraordinary to see the response. But in that war room, just describe to me, I remember it was like, okay, I think we're at 3 billion or something, and then all of a sudden it's jumping to 5 and then 6 billion. What were you seeing in real time as funds were moving?

Nick Carlsen (16:19):

Yeah, for us, right, it is that big question of, well, what else has been stolen? Because there's no centralized repository. It's not like Binance has some API ready to roll saying, "This is what's been stolen from us."

(16:29):

So it's kind of scouring across all these blockchains, you know, finding the Ripple, finding the Solana, finding the Tron.

(16:35):

And yeah, live updating that, coordinating, sharing all the data that we're finding as we find it. It is a really, yeah, like you say, a kind of inspiring process to see the density of talent as all these different various skill sets in our company came together to help figure out what this was.

Ari Redbord (16:51):

So you are seeing, you know, it's about 20 minutes, which is just absolutely crazy to see 6 billion move in 20 minutes across a whole host of different blockchains. Just describe kind of what you are seeing there and then what happens next to the funds.

Nick Carlsen (17:05):

Yes. So that initial theft, right, is mostly just the funds getting pulled out. And then for the North Koreans, it was this failing race to try to swap out of stables. And, you know, like we talked about earlier, basically the scale of this hack worked against the North Koreans because if they'd, you know, stolen 15, 20, 30 million dollars of stables, they could have swapped that out in time before Tether and Circle responded.

(17:28):

But in this case, Tether and Circle were on top of this within minutes, and they froze, yeah, one point some odd billion dollars immediately. And so, yeah, like that's such a success story that needs to be touted, you know, is that crypto's response here was so effective that we denied them almost half of what they stole.

Ari Redbord (17:47):

That was to me just absolutely extraordinary. So within 20 minutes, there's a hack of 6.3 billion. Within 37 minutes, we've already, because of Circle and Tether, been able to freeze about 2.4 billion, so about 40%, up to probably about 3 billion or so now. That is an unbelievable story.

Nick Carlsen (18:08):

Right, so the North Koreans, they're racing, they're pulling some of these stables out, moving them a few addresses to try to keep ahead of these freezes, and there was one, and I can't remember exactly how much it was, but it was a lot of money, of Tether, and Tether missed the blacklist by 20 seconds.

(18:23):

So they almost grabbed, you know, several hundred million dollars more, but the next hop, they got much of the rest before they were able to swap out of it. So, I mean, it really was, in a way that I haven't experienced in a long time, it was like a live action experience, right? Of eagerly watching to see if these next addresses would get blacklisted before the North Koreans could move the funds out.

(18:44):

And yeah, it was an extraordinary success on Tether's part.

Ari Redbord (18:47):

What's really so extraordinary, like people who haven't like seen a tool like TRM, it's like this is really a race, and you can see funds moving. I mean, the blockchains are highways where you're seeing funds move, you're seeing them get interdicted, you're seeing them move in different directions or crossroads, right?

(19:05):

I mean, it's really extraordinary to see this in the tool. So you have the 2.4 billion frozen by Tether and Circle, which is really unique. And for folks, I think most folks sort of know this stuff if they listen to this show enough. But basically, stablecoin issuers have this ability to burn, essentially remove their token from an illicit address and put it in an inaccessible wallet.

(19:28):

And Circle and Tether both used that capability at unprecedented speed and scale on Thursday. But that still leaves about 3 billion in unfreezable assets out there. And North Korea's cool with that. This has always been the cost of doing business, right? You're gonna lose funds along the way. It's rare to lose 3 billion, but like, just got to keep it moving. So how did they keep it moving?

Nick Carlsen (19:50):

Yeah. So I mean, that's the whole game for the North Koreans getting out of something that's freezable and getting into something that's not. And so for them, it's getting into Tronix, it's getting into Ethereum, it's getting into Bitcoin. That is the whole process for them. And that's what they were doing, right, that evening.

(20:06):

And up till now, right, much of this is all still just parked. You know, as long as the North Koreans don't leak their private keys, right, the stuff is not seizable. But the process that had been playing out over the weekend through the week is mostly on Tron and Solana, taking all those assets there and trying to get them across to Ethereum and Bitcoin.

(20:28):

Because that's where, you know, we talk about this a lot, the liquidity is much deeper, and there are actual obfuscation services that, right, will not guarantee anonymity to the North Koreans or even their Chinese money laundering partners, but it will give them a little bit of breathing space, which is all that they need.

(20:44):

Because this process, and we've seen this roadmap played out now over and over and over again, Bybit, right, was the best example of recent times for us, became a 24/7 thing, is now they kick off this process of pushing funds across sometimes dozens of blockchains, in a really rapid succession, you know, seconds between transactions.

(21:05):

And the whole point is to get to the very end of the race where they can swap into a stablecoin and sell that to some other broker, and be done with it. And so that's what, you know, the next six months probably is gonna be, is the digestion of this.

Ari Redbord (21:17):

I am so sorry. You think you have not slept now. When you talk about Chinese money laundering networks, I think what we have typically seen from these hacks, but not just these hacks, cartels, pig butchering networks, they are using professional money laundering services in China, Chinese organized crime. Have you seen that happen yet in this hack? And what do you anticipate happening?

Nick Carlsen (21:40):

Yeah. So our assessment basically is all of this activity we've seen on Tron is probably Chinese organized crime controlling that. And there are these networks of professional money launderers in China, often working on a commission basis. So it's kind of like a freelancer system, and it's really wild.

(21:56):

It's like a proof of the free market and its adaptability and its efficiency. But yeah, these Chinese criminals basically, coordinate this insane process with dozens of collaborators all around the world, to do this laundering process, and they follow a pretty set game plan. But yeah, the whole story here, right, is China.

(22:16):

China is this gaping hole in the international sanctions enforcement regime. And, you know, the fact that, basically, like you say, you can have drug cartels, pig butchering, and North Korean hacks all co-mingling in this kind of parallel Chinese illicit banking network, it's just an indictment of the Chinese government and its complete failure to be a responsible, you know, state on the stage.

Ari Redbord (22:40):

How does that work mechanically? I mean, you know, North Korea is selling the proceeds of this hack to these types of Chinese money laundering networks?

Nick Carlsen (22:48):

Yeah. So there's like two phases to the laundering process, right? The actual obfuscation phase, and that's commission-based, and then the actual final disposition of the assets where the North Koreans get cash or they get bank accounts or they get UnionPay cards in China. And, you know, to this kind of resounding point we keep coming back to, all this money eventually will live in China.

(23:10):

That's where it's going to be held. It's going to be held in accounts in China that can then be used to buy the goods and services that North Korea needs and wants. And so, yeah, like you look at the fuel import business, right, which was a big story a couple years ago. North Korea depends on this network of shadow fleets, that are out there hauling petroleum into North Korea, and those ships are owned by Chinese gangsters.

(23:32):

So it's no coincidence basically that you have the symbiosis of the theft and then the conversion of the theft into money and then the delivery of fuel oil to North Korea. That's all one network of criminals that do that for North Korea.

Ari Redbord (23:45):

How do we potentially stop the next North Korea hack?

Nick Carlsen (23:48):

Yeah, I think, you know, the only question here is the willingness of the US government or even the South Korean government to commit resources to this problem. If they can take tier one US offensive cyber teams and turn the Eye of Sauron on these guys, I would love for the best of the best in the United States to humble the North Korean hackers because I think they could do it.

(24:08):

But even short of that, you don't need to disrupt North Korea's hackers necessarily. You simply need to impose a parallel cost on North Korea. And that can be done, right? Like we say, there is this financial network in China that they depend upon. Attack it. Attack Chinese organized crime. These guys are vulnerable.

(24:26):

You know, when I have seen photos of them, they don't look like geniuses, Ari. They're not Silicon Valley tech bros. They are straight up gangsters, and I guarantee these guys are highly vulnerable to even relatively simple offensive cyber. So that's my answer: deploy all the tools that we have.

Ari Redbord (24:42):

No, it is a great answer and one that you've given for so many years, which is incredibly ironic as well. Nick, thank you so much for doing this with me.

TRM Labs (24:54):

If you love the show, leave a review wherever you're listening to it and follow us on LinkedIn to get the latest news on crypto regulation, compliance, and investigations. TRM Talks is brought to you by TRM Labs, the leading provider of blockchain intelligence and anti-money laundering software. This episode was produced in partnership with Voltage Productions. The music for this show was provided by iKOLIKS.

Ari Redbord (25:22):

Now, let's get back to building.