Binance Cooperating with FBI, Secret Service in $6.4 Billion Crypto Heist Investigation
Binance, the world’s largest cryptocurrency exchange, is working with the FBI and the U.S. Secret Service following a massive theft of $6.4 billion from its platform. The recovery effort has seen a significant boost as Circle, the issuer of the USDC stablecoin, has frozen over $800 million in assets linked to the attack.
A source close to the matter confirmed to Reuters that Binance is collaborating with law enforcement agencies globally, including U.S. authorities. The FBI acknowledged its awareness of the incident and stated it is working with both public and private sector partners to determine the full scope of the breach and coordinate investigative actions. The Secret Service has not yet commented.
While widely known for its presidential protection duties, the Secret Service also plays a crucial role in investigating financial crimes, including computer intrusions and offenses involving digital currencies.
Circle, which issues the stablecoin USDC, has confirmed its cooperation with law enforcement. CEO Jeremy Allaire announced that the company had frozen more than $800 million in USDC associated with the Binance incident and pledged continued support for the investigation.
Tether, the issuer of the competing USDT stablecoin, has also frozen approximately $1.5 billion in tokens. Both Circle and Tether possess the ability to blacklist specific blockchain addresses, effectively preventing the transfer of their issued tokens from compromised wallets. This capability positions stablecoin companies as key players in crypto investigations, allowing them to immobilize stolen funds before perpetrators are identified.
Paolo Ardoino, CTO of Tether, stated on X (formerly Twitter) on October 29, 2026, that Tether had frozen over $1.567 billion USDT related to a potential Binance exchange hack, emphasizing that protecting the industry and its partners is a top priority.
A Pattern of Collaboration in Digital Asset Crime Investigations
This is not the first instance of the Secret Service partnering with cryptocurrency firms to investigate digital asset crimes. In April, “Operation Atlantic,” a joint initiative involving the Secret Service, the U.K.’s National Crime Agency, Binance, Coinbase, and other crypto companies, successfully identified over 20,000 victims of phishing scams, traced $45 million in stolen funds, and froze $12 million.
North Korea Suspected in Major Crypto Attacks
The Binance investigation unfolds against a backdrop of escalating cyberattacks attributed to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis have both linked the $6.3 billion theft to “TraderTraitor,” a hacking group associated with the country’s cyber operations. This same group has also been implicated in the $1.5 billion Bybit hack in February 2025, which the FBI also attributed to North Korean hackers.
North Korean actors have previously targeted Binance, attempting to infiltrate the exchange by posing as job applicants. In a 2025 interview with Decrypt, Binance Chief Security Officer Jimmy Su revealed that North Korean operatives were actively contacting employees on LinkedIn, sometimes using fake interviews to deploy malware onto their devices.
Binance Pledges Full Reimbursement for Losses
Binance has stated it will cover all customer losses using company funds and its Secure Asset Fund for Users (SAFU), an emergency reserve designed to protect customers in the event of a security breach. CEO Richard Teng announced on Friday that the company has allocated over $6.34 billion to cover the stolen assets, with approximately $3 billion already located or frozen with the assistance of industry partners.
The exchange initially suspected that a compromised laptop belonging to a DevOps engineer may have granted attackers access to its systems. Binance has since identified additional points of breach and confirmed that no evidence suggests wallet private keys were leaked. Withdrawals remain suspended as the exchange reviews its security infrastructure, with a target resumption date set for Sunday.
