Changpeng Zhao, the founder of Binance, expressed gratitude to the U.S. Secret Service and several federal agencies for their rapid response in helping to freeze stolen cryptocurrency after a major security breach last week. The incident, which occurred on October 29, affected approximately $6.3 billion in digital assets, marking one of the largest hacks in the history of the cryptocurrency sector.
Authorities Respond to Largest Crypto Heist
Binance, the world’s largest cryptocurrency exchange by trading volume, stated that industry partners managed to freeze about $3 billion of the total assets linked to the hack. Efforts to recover the remaining assets are ongoing, with agencies continuing to investigate and trace digital funds across numerous wallets and blockchain networks.
TRM Labs, a blockchain intelligence firm specializing in cryptocurrency investigations, reported that hackers moved around $6.36 billion across ten separate blockchain networks within roughly 20 minutes after initiating the attack.
The U.S. Secret Service confirmed that its investigators teamed up with the crypto industry almost immediately after the theft to identify and secure a significant portion of the stolen assets. The Department of Justice’s Computer Crime and Intellectual Property Section, along with the National Security Division, are also providing support. Key agencies participating in the case include the FBI, IRS Criminal Investigation, and U.S. Attorneys’ Offices for both the District of Columbia and the Central District of California.
The U.S. Secret Service emphasized that the quick actions of agencies and industry partners were critical in minimizing damage from the incident and reducing the risk of further disruption across both crypto markets and broader financial systems.
North Korean Group Identified as Suspect
The FBI identified a hacking group known as TraderTraitor, which is associated with North Korea, as the perpetrators of the Binance attack. According to investigators, the attackers primarily converted the stolen assets into Ethereum and are expected to continue laundering funds through decentralized finance protocols and instant swap services. These platforms allow users to exchange digital assets directly without relying on a traditional exchange.
Law enforcement agencies have requested that node operators, DeFi services, instant exchanges, and blockchain analytics firms block any transactions connected to the compromised funds. The FBI has also published a list of Ethereum wallet addresses associated with the suspected hackers.
Research from Chainalysis, a leading blockchain analysis firm, indicates that North Korean hackers were responsible for about 89% of all crypto-related thefts in 2026. The Binance breach now surpasses the $1.5 billion Bybit hack from February 2025 as the largest crypto exchange security breach on record.
Binance’s initial internal review revealed that the attackers may have accessed the exchange by compromising a DevOps engineer’s laptop, giving them control over an internal tool used for processing withdrawals. Binance reported finding no evidence of leaked wallet private keys. As a security measure, the company promptly revoked the affected access and temporarily paused withdrawals during its investigation.
Market reaction was immediate. The value of Bitcoin and several major altcoins dropped sharply following news of the hack. On October 30, total liquidations in the market surpassed $1.5 billion.
Binance stated it will use company resources as well as its Secure Asset Fund for Users to fully cover affected customers’ losses. However, the final financial impact will depend on how much is eventually recovered from the stolen assets.
The FBI urged anyone with relevant information on the attackers or related transactions to get in touch through a local field office or the Internet Crime Complaint Center.
In a statement posted on X, Changpeng Zhao credited agencies and industry partners with acting within minutes of the attack. He highlighted their role in containing the breach’s aftermath and reducing systemic risks to digital and broader financial markets.
Mini dictionary: TRM Labs, a blockchain intelligence company, provides advanced analytics and investigation tools for financial institutions and law enforcement to trace the movement of digital assets and detect illicit activities on blockchain networks.
| Exchange | Hack Amount | Date | Funds Frozen |
|---|---|---|---|
| Binance | $6.3 billion | October 2026 | $3 billion |
| Bybit | $1.5 billion | February 2025 | Undisclosed |
