Binance working with FBI, Secret Service after $6.4 billion hack, Reuters reports
In brief
- Binance is working with the FBI and Secret Service, Reuters reported, citing a source.
- FBI said it was aware of the incident and working with partners.
- USDC worth more than $800 million was frozen, Circle's Jeremy Allaire said.
- Binance reserved more than $6.34 billion to cover stolen assets, Richard Teng said.
- TRM Labs and Chainalysis linked the theft to North Korea-associated group TraderTraitor.
What the agencies have said
A person familiar with the matter told Reuters that Binance was cooperating with law enforcement agencies worldwide, including both U.S. agencies. The FBI confirmed it was aware of the incident and was working with public and private partners to assess its scope and coordinate investigative steps.
The Secret Service didn't comment. Its remit covers computer crimes, unauthorized access to computer systems and crimes involving digital currencies, and it's worked alongside Binance before (in April, Operation Atlantic, a joint effort with the U.K.'s National Crime Agency, Binance, Coinbase and other firms, identified over 20,000 approval phishing victims, traced $45 million and froze $12 million).
Circle and Tether freeze tokens
Circle, issuer of the USDC stablecoin, confirmed it's coordinating with law enforcement. CEO Jeremy Allaire said the company had frozen more than $800 million in USDC associated with the Binance incident and would continue supporting the investigation. Tether, which issues USDT, froze another $1.5 billion in tokens; a post from Paolo Ardoino's account put it at more than 1.567B USDT "related to a potential Binance exchange hack."
Both issuers can blacklist specific blockchain addresses, which stops their tokens from being transferred out of those wallets.
Protecting the industry and our partners is our main priority.
Paolo Ardoino, in a post on X
Binance's reserve and the North Korea link
Binance CEO Richard Teng said on Friday the company had reserved more than $6.34 billion to cover stolen assets, and that approximately $3 billion had been located or frozen with industry partners. Binance said it'll cover all losses using company funds and its Secure Asset Fund for Users (an emergency reserve for security breaches).
The exchange initially suspected that a compromised laptop belonging to a DevOps engineer gave attackers access. It has since identified additional points of breach and said it found no evidence that wallet private keys were leaked. Withdrawals remain suspended while Binance reviews its security infrastructure, and the company is targeting a resumption by Sunday.
Blockchain intelligence firms TRM Labs and Chainalysis have both linked the theft (Decrypt cites a $6.3 billion figure in that context) to TraderTraitor, a hacking group associated with North Korea's cyber operations. That group has been linked to the $1.5 billion Bybit hack in February 2025, which the FBI also attributed to North Korean hackers.
North Korean attackers have gone after Binance itself before, including by posing as job applicants. Binance Chief Security Officer Jimmy Su told Decrypt in 2025 that operatives contacted employees on LinkedIn daily, sometimes using fake interviews to deliver malware.
Frequently asked questions
How can Circle and Tether freeze stablecoins tied to the Binance hack?
Circle and Tether can blacklist specific blockchain addresses, which prevents their tokens from being transferred out of those wallets. Circle CEO Jeremy Allaire said the company froze more than $800 million in USDC associated with the incident, and a post from Paolo Ardoino's account said Tether froze more than 1.567B USDT.
Who have analysts linked to the Binance hack?
Blockchain intelligence firms TRM Labs and Chainalysis have both linked the theft to TraderTraitor, a hacking group associated with North Korea's cyber operations. The same group has been linked to the $1.5 billion Bybit hack in February 2025, which the FBI also attributed to North Korean hackers.
How is Binance covering losses from the hack?
Binance said it will cover all losses using company funds and its Secure Asset Fund for Users, an emergency reserve for security breaches. CEO Richard Teng said the company reserved more than $6.34 billion to cover stolen assets, and that approximately $3 billion had been located or frozen with industry partners.
