Fed and OCC question banks after $6.3 billion Binance hack

The Federal Reserve and the Office of the Comptroller of the Currency contacted U.S. banks after last week's $6.3 billion Binance hack, Reuters reported Thursday, citing several people familiar with the matter.

Supervisors from both agencies began reaching banks Monday morning, asking whether they had seen unusual activity, disruption or vulnerabilities in their systems.

Bitcoin Magazine, citing Reuters, described the incident as the largest crypto theft on record. Together, the contacts show regulators treating the breach as a potential risk to traditional finance, not only a problem for crypto exchanges.

What are regulators asking banks to check?

One bank contacted by regulators told Reuters it had experienced no service disruptions. Employees at that bank prepared talking points for customers but have since received few inquiries, the source said.

Two people familiar with the effort said banks have studied the attack and run diagnostics to determine whether they could defend against similar tactics.

Within hours, a cybersecurity team at one of the largest U.S. banks contacted its counterpart at Binance. That team is writing an internal report that will lead to a review of the bank's systems and may lead to cybersecurity updates. It remains unclear whether that bank was vulnerable to the tactics used in the Binance attack.

One source identified the rapid evolution of artificial intelligence models as the banks' biggest concern, saying it had become harder for them to keep pace with hackers. Banks are devoting substantial resources to reviewing and patching their cybersecurity code as they assess the threat.

Binance said it was unaware of conversations between banks and regulators and did not know whether the hack had affected U.S. banks. A Binance spokesperson said: “We are in close contact with regulators all over the world, keeping them up to date on this security breach.”

How did the $6.3 billion theft unfold?

Binance said the operation began with a fake job interview and ran for five months before any coins moved. The campaign paired a poisoned software download and malware designed to evade endpoint detection with a staged recruitment process.

The attackers also turned an internal AI tool against Binance's own wallet engineers, according to the exchange's account.

Binance said funds began leaving its hot wallets across multiple blockchains on Oct. 29. Blockchain analysis firms Chainalysis and TRM Labs linked the hack to TraderTraitor, a unit associated with North Korea.

Binance reopened withdrawals in stages four days later, beginning with bitcoin. The exchange said it froze or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds. Because Binance funded the replenishment, the exchange bore most of the immediate cost of restoring affected token balances.

Why is the breach reaching traditional banks?

Binance said the techniques were not unique to crypto. Social engineering, malicious downloads and compromised internal tools create risks for every large financial institution. That shared exposure helps explain why one bank's cybersecurity team moved within hours.

The timing also matters. Over the preceding 18 months, U.S. regulators had cleared a path for banks to expand their crypto businesses.

• In March 2025, the OCC rescinded its requirement that national banks obtain supervisory nonobjection before engaging in crypto custody and stablecoin activities.
• In April 2025, the Fed withdrew guidance requiring state member banks to notify it before starting crypto activities.

As more banks custody bitcoin, issue stablecoins and serve exchanges, a breach at a major crypto platform becomes a question for bank supervisors as well as crypto regulators.

The wider banking sector is not insulated from large thefts. On Wednesday, French bank Credit Mutuel Arkea confirmed a cyberattack that allowed fraudulent transfers from its own account. An on-chain investigator put the loss at more than $133 million, but the bank has not confirmed that estimate and said customer assets were unaffected.

Will the reviews lead to new guidance?

Neither the Fed nor the OCC has publicly announced new guidance tied to the hack. The next checkpoint is whether bank reviews produce cybersecurity updates or formal supervisory guidance; without such a change, the outreach remains a bank-by-bank diagnostic exercise rather than a new regulatory regime.