In brief

  • Binance is working with the FBI and U.S. Secret Service after hackers stole $6.4 billion from the cryptocurrency exchange, according to Reuters.
  • Circle froze approximately $823 million in USDC connected to the attack, while Tether froze another $975.1 million in USDT. Circle CEO Jeremy Allaire said the company was coordinating with law enforcement.
  • Blockchain intelligence firms TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean hacking group previously linked to the $1.5 billion Bybit hack.

Binance is working with the FBI and U.S. Secret Service after hackers stole $6.4 billion from the cryptocurrency exchange, as Circle joins the recovery effort by freezing more than $800 million in assets connected to the attack, according to Reuters.

A person familiar with the matter told Reuters that Binance was cooperating with law enforcement agencies around the world, including both U.S. agencies. The FBI confirmed it was aware of the incident and was working with public and private partners to assess its scope and coordinate investigative steps. The Secret Service remained silent.

Investigating financial crimes is part of the Secret Service’s job, beyond its better-known responsibility of protecting the president. The agency also investigates computer crimes, unauthorized access to computer systems, and crimes involving digital currencies.

Circle, the company behind USDC, a stablecoin designed to maintain a value of $1, has separately confirmed that it is coordinating with law enforcement. CEO Jeremy Allaire said the company had frozen more than $800 million in USDC associated with the Binance incident and would continue supporting the investigation.

Tether, which issues the competing USDT stablecoin, froze another $1.5 billion in tokens. Both companies can blacklist specific blockchain addresses, preventing the tokens they issue from being transferred out of those wallets. That ability gives stablecoin companies an unusual role in crypto investigations: they can effectively immobilize stolen money before investigators identify the people responsible.

Tether froze more than 1.567B USDT related to a potential Binance exchange hack.

Protecting the industry and our partners is our main priority.

— Paolo Ardoino 🤖 (@paoloardoino) October 29, 2026

This is not the first time the Secret Service has worked alongside crypto companies to investigate digital asset crimes. In April, Operation Atlantic—a joint effort involving the Secret Service, the U.K.'s National Crime Agency, Binance, Coinbase, and other crypto firms— identified more than 20,000 victims of approval phishing scams, traced $45 million in stolen funds and froze $12 million.

The Binance investigation also comes against the backdrop of a growing number of attacks attributed to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis have both linked the $6.3 billion theft to TraderTraitor, a hacking group associated with the country's cyber operations. The same group has been linked to the $1.5 billion Bybit hack in February 2025, which the FBI also attributed to North Korean hackers.

North Korean attackers have targeted Binance itself before, including through attempts to infiltrate the exchange by posing as job applicants. In an interview with Decrypt in 2025, Binance Chief Security Officer Jimmy Su said North Korean operatives were contacting employees on LinkedIn every day, sometimes using fake interviews to deliver malware to their devices.

Binance has said it will cover all losses using company funds and its Secure Asset Fund for Users, an emergency reserve designed to protect customers in the event of a security breach. CEO Richard Teng said on Friday that the company had reserved more than $6.34 billion to cover the stolen assets, while approximately $3 billion had already been located or frozen with the help of industry partners.

The exchange initially suspected that a compromised laptop belonging to a DevOps engineer had provided the attackers with access to its systems. It has since identified additional points of breach and said it found no evidence that wallet private keys had been leaked. Withdrawals remain suspended while Binance reviews its security infrastructure, with the company targeting a resumption by Sunday.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.