CFTC Chief Cites $6.4 Billion Binance Hack to Push US Oversight of Offshore Exchanges

The largest theft in crypto history — roughly $6.4 billion drained from Binance — "proves our exact point" about the need for U.S. oversight of offshore crypto exchanges, Commodity Futures Trading Commission Chairman Michael Selig told CNBC on Friday. Selig used the incident to press the case for a federal rulebook the agency proposed earlier this month, one that would allow offshore venues to register with the CFTC and submit to the same cybersecurity standards that govern U.S. markets.

What does the CFTC chair want?

Selig's argument rests on a jurisdictional gap, not a technological failure. "The real issue here is that these are unregulated offshore exchanges, and they don't have the same sorts of safeguards that we have in our financial markets here in the United States," he said. His proposed "federal option" would let platforms like Binance volunteer into a CFTC-supervised regime — a pitch that, notably, depends on offshore firms choosing to accept U.S. rules they can currently avoid.

The chair also sought to downplay blockchain risk. The exploit, he said, did not break the underlying chain — Ethereum — or its smart contracts, but exploited a vulnerability he believed was "introduced from someone's laptop," a category of incident traditional markets know well. The difference in crypto, according to Selig, is speed: funds move faster, and attackers can route them through tools like Tornado Cash to obscure their trail. That claim deserves scrutiny, because the on-chain mechanics were central to how the theft actually worked.

What did the attack actually involve?

Selig's laptop framing may already be outdated. Binance initially blamed a compromised DevOps engineer's laptop, but said Friday its investigation had uncovered "additional points of breach." CEO Richard Teng called it "a more complex attack process" that "did not simply use one engineer's permissions." In plain words: the single-employee explanation was preliminary, and the company itself has walked it back.

The attack did not expose a flaw in Ethereum itself, yet it played out partly on-chain. The attacker used EIP-7702 — an Ethereum feature that lets ordinary wallets execute smart-contract code — to convert a Binance hot wallet into a "sweeper" through 50 pre-signed authorizations, draining its assets. Blockchain-analytics firm TRM Labs assessed that the broader breach points to a compromise of Binance's signing infrastructure rather than a weakness in any blockchain.

Selig nonetheless framed blockchain transparency as a regulatory asset. "The fact that we can trace transactions on-chain, even when some of these technologies are used to obfuscate that, gives regulators a lot of potential to be really cop on the beat here," he said. Traceability aids investigation; it did not prevent the theft, and recovering funds after mixing remains slow and uncertain.

Where does the rulemaking stand?

The comments sharpen a campaign Selig has run for weeks. The CFTC has pressed ahead with its own crypto rulemaking rather than wait on Congress, sending the White House proposals that would define event contracts as "swaps" and floating a plan to bring crypto exchanges under federal oversight. The move reflects a broader shift in which agencies have taken the lead after the Clarity Act stalled in the Senate — meaning the executive branch, not legislators, is currently writing the market's operating rules.

The Binance hack supplies that effort with its most vivid exhibit to date. To put the scale in perspective: $6.4 billion is more than the annual budget of several U.S. federal financial regulators combined, and Binance has set aside $6.34 billion to cover losses while assuring users their assets are safe. That assurance is a balance-sheet promise, not an audited guarantee.

The enforcement response is already underway. The Secret Service and FBI have opened a probe, and TRM Labs and Chainalysis have attributed the theft to North Korea's TraderTractor-linked TraderTraitor group — a state-sponsored actor with a long record of exchange breaches. Attribution by analytics firms is an assessment, not a conviction, and no charges have been announced.

The stakes now turn procedural. If the CFTC's proposed rules clear the White House review, offshore exchanges will face a concrete choice: register under U.S. cybersecurity standards or explain to clients, insurers and investigators why they declined — and the comment period ahead will determine how enforceable that "federal option" becomes.