Lifestyle

Binance Hack: Withdrawals Paused as FBI and Secret Service Join Probe and Circle, Tether Freeze Stablecoins

Decrypt reports that hackers stole about $6.4 billion from crypto exchange Binance, which is working with the US FBI and Secret Service. Customers' withdrawals are paused, with a target to resume by Sunday. Binance says it will cover all losses with company funds and its emergency reserve, while Circle and Tether have frozen related stablecoins.

About 5 min read

Binance Hack: Withdrawals Paused as FBI and Secret Service Join Probe and Circle, Tether Freeze Stablecoins
Image: Mokaair (Original editorial artwork)

Everything below comes from a report by the crypto news site Decrypt, which partly cites Reuters. Some figures in the report are inconsistent with one another; they are flagged below.

What happened: the investigation widens to US law enforcement

Decrypt (citing Reuters) reports that Binance is working with the FBI and the US Secret Service after hackers stole $6.4 billion from the exchange. According to Decrypt, a person familiar with the matter told Reuters that Binance is cooperating with law enforcement agencies worldwide, including these two US agencies.

Decrypt says the FBI confirmed it is aware of the matter and is working with public and private partners to assess its scope and coordinate investigative steps; the Secret Service did not respond. Decrypt also notes that, besides its better-known role protecting the president, the Secret Service investigates financial crimes, computer crimes, unauthorized access to computer systems, and crimes involving digital currency.

Stablecoin freezes: why stolen funds can be stopped

Decrypt explains that USDC, issued by Circle, is a "stablecoin" (a cryptocurrency pegged to the US dollar) designed to hold a value of $1; USDT, issued by Tether, is a competing stablecoin.

Decrypt reports that Circle froze about $823 million in USDC tied to the attack, and CEO Jeremy Allaire said the company is coordinating with law enforcement. For Tether, Decrypt's summary says $975.1 million in USDT was frozen, the body text says $1.5 billion, and the post by Tether CEO Paolo Ardoino quoted in the article says more than 1.567 billion USDT. The figures within the same report are inconsistent.

Decrypt explains that both Circle and Tether can blacklist specific blockchain addresses so tokens they issue cannot be moved out of those wallets. This can immobilize stolen funds before investigators identify the people responsible.

Parties' actions as compiled from Decrypt's report (figures are inconsistent)
PartyWhat Decrypt reports
BinanceWorking with the FBI and Secret Service; says it will cover all losses with company funds and SAFU; withdrawals paused
CircleFroze about $823 million in USDC; CEO says it is coordinating with law enforcement
TetherFrozen amount given in Decrypt's report as $975.1 million, $1.5 billion and 1.567 billion USDT
FBIConfirmed it is aware of the incident; assessing scope and coordinating investigative steps
Secret ServiceReportedly did not respond
TRM Labs, ChainalysisAttribute the attack to TraderTraitor, a hacking group linked to North Korea

Who is blamed and how the attackers got in

Decrypt reports that blockchain intelligence firms TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korea-linked hacking group previously tied to the $1.5 billion Bybit hack in February 2025; the FBI also attributed the Bybit case to North Korean hackers. In addition, Decrypt's body text puts the amount stolen at $6.3 billion, slightly different from the $6.4 billion in its summary.

Decrypt says Binance initially suspected that a compromised laptop of a DevOps (system development and operations) engineer gave the attackers system access, and later found other points of entry. Binance said it found no evidence that wallet private keys (the cryptographic keys used to move a wallet's assets) were exposed.

What it means for Binance users

  • Compensation: Decrypt reports Binance says it will compensate all losses with company funds and SAFU (the Secure Asset Fund for Users, an emergency reserve set up against security incidents).
  • Reserves and recovery: Decrypt reports CEO Richard Teng said more than $6.34 billion has been set aside, and about $3 billion has been located or frozen with help from industry partners.
  • Withdrawals: Decrypt reports withdrawals remain paused while Binance reviews its security infrastructure, with a target to resume by Sunday.

Decrypt also mentions "Operation Atlantic" this April, in which the Secret Service, the UK's National Crime Agency, Binance, Coinbase and others identified more than 20,000 victims of approval phishing scams, traced $45 million in stolen funds and froze $12 million. The report also recalls that Binance chief security officer Jimmy Su said in a 2025 interview that North Korean operatives contact employees via LinkedIn every day, sometimes using fake job interviews to deliver malware to their devices.

Frequently asked questions

What is the source of this news?

The information comes from Decrypt's October 30, 2026 report, which partly cites Reuters. For later developments, rely on official announcements from Binance and other parties.

How much was actually stolen?

Decrypt's summary and opening say $6.4 billion, while one passage in the body says $6.3 billion. Both figures appear in the same report, which does not say which is more accurate.

Will anyone cover users' losses?

According to Decrypt, Binance says it will compensate all losses with company funds and SAFU, and has set aside more than $6.34 billion. This is Binance's own statement.

When will withdrawals resume?

Decrypt reports withdrawals remain paused, and Binance aims to resume by Sunday. That is a target, not a guarantee.

Who is believed to be behind it?

Decrypt reports that blockchain intelligence firms TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korea-linked group. This is those two firms' assessment.

Browse the latest news in this topic

Sources

Lifestyle