Binance is cooperating with the Federal Bureau of Investigation and the U.S. Secret Service following a security breach that resulted in the theft of approximately $6.3 billion to $6.4 billion in cryptocurrency. The exchange has confirmed it is working with law enforcement agencies worldwide to recover the stolen assets, while private-sector partners have already immobilized a substantial portion of the funds.

Law Enforcement Involvement

The FBI stated it is aware of the incident and is coordinating with public and private partners to assess its scope and potential impact. The U.S. Secret Service is also examining reports of the breach alongside private-sector partners, including Circle, the issuer of the USDC stablecoin. The Department of Justice is aware of the reports. Investigating financial crimes and unauthorized access to computer systems forms part of the Secret Service’s responsibilities in the digital asset space.

Binance has set aside more than $6.34 billion of its own funds, including through its Secure Asset Fund for Users, to cover customer losses. Of that amount, roughly $5 billion is held in the same tokens affected by the attack. The company reported that approximately $3 billion in stolen assets has already been located or frozen with assistance from industry partners.

Stablecoin Freezes and Industry Response

Circle confirmed it froze more than $800 million, specifically about $823 million, in USDC linked to the incident and is coordinating with law enforcement. Circle CEO Jeremy Allaire stated the company would continue supporting the investigation. Tether, issuer of USDT, froze more than $1.5 billion in related tokens, with one update citing over $1.567 billion.

Stablecoin issuers can blacklist blockchain addresses, preventing further transfers of their tokens and providing an immediate tool to immobilize funds during investigations.

Attribution and Technical Details

Blockchain intelligence firms have attributed the attack to TraderTraitor, a North Korean-linked hacking group previously connected to the $1.5 billion Bybit incident in early 2025. North Korean actors have targeted Binance in the past through social engineering attempts, including fake job applications and LinkedIn outreach aimed at delivering malware.

Binance initially pointed to a compromised laptop belonging to a DevOps engineer as a possible entry point. The exchange later identified additional breach points but reported no evidence that wallet private keys were leaked. Withdrawals remain suspended while the company reviews its security systems, with a target of resuming operations by Sunday.

Market Position and Outflows

Binance holds about $134 billion in total reserves, maintaining its position as the largest cryptocurrency exchange by that measure. The platform recorded roughly $6 billion in withdrawals within a 24-hour period after the incident became public.

Binance CEO Richard Teng confirmed the reservation of company funds to fully cover the impacted assets. The exchange continues to work with partners to retrieve the remaining stolen cryptocurrency.