Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million

What it is

Binance lost about $6.4 billion in a theft reported by Reuters and relayed by Decrypt on 30 October 2026. Binance is working with the FBI and U.S. Secret Service. TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean group also linked to the $1.5 billion Bybit hack of February 2025, which the FBI attributed to North Korean hackers. The FBI confirmed it is aware of the incident. The Secret Service has not commented.

How it works

Binance first suspected a compromised laptop belonging to a DevOps engineer gave the attackers access. It has since found additional breach points, which the page does not describe. Binance says it found no evidence that wallet private keys leaked. The page gives no technique for the intrusion itself.

The page adds context on the threat actor. Binance CSO Jimmy Su told Decrypt in 2025 that North Korean operatives contact employees on LinkedIn daily, sometimes using fake interviews to deliver malware.

What to do

The page gives no remediation steps for other organisations. Two of its facts bear on defence:

• Developer and DevOps endpoints are the suspected entry point, and the stated recruiting-lure pattern targets staff directly.
• Circle and Tether can blacklist addresses so tokens cannot move out of them. The page says this lets issuers immobilise stolen funds before investigators identify the people responsible.

Caveats

The page's figures conflict:

• The theft is $6.4 billion in the lede and $6.3 billion later in the text.
• Tether's freeze is $975.1 million in the summary box, "$1.5 billion" in the body, and "more than 1.567B USDT" in the embedded Paolo Ardoino post of 29 October 2026.
• Circle's freeze is "approximately $823 million" in the summary box and "more than $800 million" in Allaire's quoted statement.

Binance CEO Richard Teng said on Friday that the company reserved more than $6.34 billion to cover losses, funded from company money and its Secure Asset Fund for Users. About $3 billion has been located or frozen with industry partners. Withdrawals remain suspended, with resumption targeted by Sunday.

The page also cites Operation Atlantic from April 2026: the Secret Service, the U.K. National Crime Agency, Binance, Coinbase and others identified over 20,000 approval-phishing victims, traced $45 million and froze $12 million. The attribution to TraderTraitor comes from the two analytics firms, and the page does not say the FBI has confirmed it for this incident.