Binance $6.4B Hack Draws FBI Probe and Stablecoin Freezes

Binance is working with the FBI and U.S. Secret Service after hackers stole $6.4 billion from the cryptocurrency exchange, according to Reuters. CEO Richard Teng said on Friday that Binance reserved more than $6.34 billion to cover the stolen assets.

A person familiar with the matter told Reuters that Binance was also cooperating with law-enforcement agencies worldwide. The FBI confirmed it was aware of the incident and was working with public and private partners to assess its scope and coordinate investigative steps; the Secret Service remained silent.

The Secret Service's financial-crime remit includes unauthorized computer access and crimes involving digital currencies. Those duties sit alongside its better-known responsibility of protecting the president.

What do the stablecoin freezes cover?

Circle, issuer of the USDC stablecoin, confirmed it was coordinating with law enforcement. USDC is designed to maintain a $1 value, and CEO Jeremy Allaire said the company had frozen more than $800 million linked to the Binance incident. Reuters put the total at approximately $823 million; Allaire said Circle would continue supporting the investigation.

Reuters' report cited three figures for Tether, the issuer of the competing USDT stablecoin:

• $975.1 million in USDT in the summary.
• $1.5 billion in tokens in the main text.
• More than 1.567 billion USDT in an October 29, 2026 post.

Paolo Ardoino wrote on October 29, 2026: “Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.” Reuters did not reconcile the figures.

Circle and Tether can blacklist specific blockchain addresses, preventing tokens they issue from transferring out of those wallets. That ability lets stablecoin issuers immobilize stolen funds before investigators identify the people responsible, giving them a direct recovery role.

Who is TraderTraitor?

TRM Labs and Chainalysis linked the theft to TraderTraitor, a North Korean hacking group associated with the country's cyber operations. Both firms used a $6.3 billion loss estimate, compared with Reuters' $6.4 billion figure. The same group has been linked to the $1.5 billion Bybit hack in February 2025, which the FBI attributed to North Korean hackers.

North Korean attackers have previously sought access to Binance by posing as job applicants. In a 2025 interview with Decrypt, Binance Chief Security Officer Jimmy Su said operatives contacted employees on LinkedIn every day, sometimes using fake interviews to deliver malware to their devices.

How did Binance contain the breach?

The exchange initially suspected that attackers had entered its systems through a compromised laptop belonging to a DevOps engineer. Binance later identified additional breach points and said it had found no evidence of leaked wallet private keys.

Binance will cover all losses with company funds and its Secure Asset Fund for Users, an emergency reserve designed to protect customers after a security breach. Industry partners had already located or frozen approximately $3 billion in assets, Teng said.

Withdrawals remain suspended while Binance reviews its security infrastructure. The suspension constrains customer access to funds until the review produces a restart decision.

What changes for enforcement?

The Secret Service has worked with crypto companies before. In April, Operation Atlantic brought together the agency, the U.K.'s National Crime Agency, Binance, Coinbase and other crypto firms.

The operation identified more than 20,000 victims of approval-phishing scams, traced $45 million in stolen funds and froze $12 million. The case shows how exchanges and stablecoin issuers can combine victim reporting, fund tracing and address controls with cross-border police work.

The immediate deadline is Sunday's planned withdrawal resumption after the infrastructure review. Investigators will continue assessing the attack's scope and tracing assets not yet located or frozen.