Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million

On October 29, 2026, hackers siphoned roughly $6.3 billion from Binance’s hot wallets across ten blockchains, prompting an emergency response from U.S. law‑enforcement and stablecoin issuers. The FBI and the U.S. Secret Service joined Binance’s own investigation, while Circle froze about $823 million of USDC and Tether locked up roughly $975 million of USDT linked to the breach. Blockchain intelligence firms TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean hacking unit previously tied to the $1.5 billion Bybit hack.

Background

Binance, the world’s largest cryptocurrency exchange, has long been a target for state‑backed actors. In early 2025, the exchange disclosed that North Korean operatives had repeatedly attempted to infiltrate its staff via fake job postings on professional networks, a tactic later confirmed by its chief security officer. The exchange’s Secure Asset Fund for Users, an emergency reserve, was already earmarked with more than $6.34 billion to cover potential losses. Stablecoin issuers Circle and Tether possess the technical ability to blacklist specific blockchain addresses, effectively immobilising tokens on their contracts. This capability has been deployed before, such as during Operation Atlantic in April, a joint effort that involved the Secret Service, the U.K.’s National Crime Agency, Binance, Coinbase and other firms, which resulted in the freezing of $12 million and the identification of over 20,000 phishing victims. The current breach unfolded after a compromised laptop belonging to a Binance DevOps engineer allegedly allowed attackers to sign unauthorized withdrawals from the exchange’s hot wallets, a method that left no evidence of private‑key leakage. The rapid freeze of stablecoins by Circle and Tether represents a coordinated industry response that seeks to limit the attacker’s ability to move value, even as the hackers turned to decentralized finance protocols like Aave to convert frozen assets into native ETH.

What happened

According to decrypt.co, the hack began when a compromised laptop gave the attacker access to a Binance service container, enabling unauthorized withdrawals that drained $6.4 billion from the exchange’s hot wallets. The FBI confirmed it was aware of the incident and was working with public and private partners to assess its scope, while the Secret Service, whose mandate includes investigating computer crimes, also joined the probe, though it remained silent publicly. Circle’s CEO Jeremy Allaire said the company froze more than $800 million in USDC in coordination with law enforcement, and Tether’s Paolo Ardoino announced a freeze of roughly $975 million in USDT. Both issuers can blacklist addresses, preventing further transfers of the frozen tokens. TRM Labs and Chainalysis linked the theft to TraderTraitor, a North Korean hacking group previously tied to the $1.5 billion Bybit hack in February 2025. The attacker moved part of the stolen USDT into Aave V3 on October 29, depositing about $60 million as collateral and borrowing roughly $44.6 million worth of WETH, which was then unwrapped into ETH to evade the stablecoin freezes. Bitquery analysis showed the hacker also used UniswapX and 1inch to swap about $325 million of USDT for ETH, accepting a premium of roughly 16% over market prices. Binance reported that roughly $3 billion of the stolen assets had been frozen by industry partners, with the exchange promising to cover all losses from its own funds. The exchange paused withdrawals, expecting to resume them by the following Sunday, while the broader market reacted with an 8.7% drop in BNB and Bitcoin slipping below $77,000.

Market impact

The hack triggered an immediate sell‑off, with Binance’s native token BNB falling 8.7% within an hour and Bitcoin slipping below $77,000. Leveraged positions worth about $1.5 billion were liquidated as the market reacted to the breach. Stablecoin freezes by Circle and Tether immobilised roughly $2.6 billion of the stolen funds, while Binance estimates that about $3 billion has been frozen in total, including actions by other industry partners. The attacker’s use of Aave resulted in the borrowing of approximately $44.6 million in ETH, and the subsequent decentralized swaps on UniswapX and 1inch moved an estimated $325 million of USDT into ETH, albeit at a 16% price premium. These flows illustrate how quickly value can move from centralized to decentralized protocols, creating volatility across both token classes and the broader crypto market.

Why it matters

The incident underscores the growing threat posed by state‑backed hacking groups to major crypto infrastructure, highlighting the vulnerability of even the largest exchanges to insider‑related compromises. The coordinated response by law‑enforcement, Circle and Tether demonstrates the expanding role of stablecoin issuers in crypto forensics, as their ability to blacklist addresses can temporarily stem the flow of illicit funds. However, the attacker’s swift migration of frozen stablecoins into decentralized lending platforms like Aave shows the limits of such controls and the need for broader cross‑protocol safeguards. The breach also pressures regulators, as evidenced by CFTC Chairman Michael Selig citing the hack in support of a voluntary registration framework for offshore exchanges serving U.S. retail traders, indicating that high‑profile thefts may accelerate policy action aimed at improving cybersecurity standards across the industry.