Platforms · Software · Providers · Markets
US agencies coordinate the response
The US Secret Service confirmed on 30 October 2026 that it is working with Circle to help recover funds from the $6.3 billion breach at Binance. The confirmation came a day after the incident. Cryptocurrency firms are also involved in the response.
The FBI said it knew about the breach and was assessing its effects alongside public- and private-sector partners while coordinating investigative work. Reuters, citing a person familiar with the matter, reported that Binance was working with the FBI and the US Secret Service.
Issuers restrict movement of tokens
Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC connected to the breach, working with law enforcement. Tether CEO Paolo Ardoino said the issuer had also frozen nearly $1.57 billion in related USDT.
The two issuers' actions account for more than $2.37 billion. Binance has put the value frozen by industry partners at around $3 billion, including steps taken by other firms.
Circle and Tether can block transfers from particular blockchain addresses. That restriction alone does not show that assets have been recovered or returned to affected users.
Attribution and regulation broaden scope
Binance's broader freeze estimate and the difference between restricting transfers and recovering funds were reported by Finance Magnates. Separately, TRM Labs linked the attack to TraderTraitor, a North Korean hacking group, with high confidence. The firm said it drew on on-chain and off-chain intelligence, and is following the funds and notifying industry partners through Beacon Network.
CFTC Chairman Michael Selig has pointed to the breach in arguing for a proposed voluntary registration framework covering offshore cryptocurrency exchanges that serve US retail traders. Platforms taking part would need to meet US cybersecurity and customer protection standards. Selig said wider federal registration would need congressional action, with the CFTC targeting 14 December 2026 for the proposed rulemaking.
What an operations team should check
Operations teams should distinguish issuer-level transfer restrictions from funds recovered or returned to customers when updating incident records and balances. The report does not identify the affected blockchain addresses or give a chain-by-chain breakdown. Teams should establish which address data they can rely on, who maintains it and how any internal exposure checks will be reconciled against subsequent updates.
Risk and compliance teams at firms serving US retail traders should track the proposed CFTC framework and ask whether it would apply to their platform if they chose to participate. They should also establish what evidence of cybersecurity and customer protection controls would be needed. The source does not specify the proposed rule's detailed requirements.
