Fed and OCC Reportedly Called US Banks After $6.3 Billion Binance Hack as North Korea Denies Role

Since attackers drained about $6.3 billion from Binance on Oct. 29, the FBI has named North Korea, the exchange has made customers whole, and the story has moved from the crypto world into the banking system.

Bank supervisors start making calls

Staff at the Federal Reserve and the Office of the Comptroller of the Currency began phoning US banks on Monday, Nov. 2, to ask whether their systems had held up, Reuters reported, citing several people familiar with the matter. Supervisors asked about unusual activity or service disruptions. One bank source told Reuters there were none.

Both agencies declined to comment. Binance said it was unaware of the conversations.

The banks aren't waiting on regulators. Two people told Reuters that lenders are running their own checks on whether they could withstand a similar attack. A cybersecurity team at one of the largest US banks contacted Binance counterparts within hours of the theft and is writing an internal report that could trigger a review of the bank's own systems, a source told Reuters.

One person familiar with the reviews told Reuters the big worry is that AI models are evolving quickly, making it hard for banks to keep pace with attackers.

What the FBI says

On Saturday, Oct. 31, the FBI said the theft was tied to "malicious cyber activity" by a North Korean actor it calls TraderTraitor. The same group was behind last year's $1.5 billion Bybit hack, the bureau said.

The FBI said it had watched TraderTraitor convert the stolen assets, mostly into ethereum, and expects further laundering through DeFi platforms and "instant swap services." It asked crypto exchanges, blockchain analytics firms and other private companies to block transactions tied to a list of addresses it published.

Private tracing firms reached the same conclusion before the bureau did. TRM Labs pointed to "robust on and off-chain intelligence" and features matching earlier North Korea-linked heists. Chainalysis said it had "high confidence."

Pyongyang rejects it. On Tuesday, Nov. 3, Kim Yo Jong, the sister of Kim Jong Un, called the allegation "absurd rhetoric" and part of Washington's "persistent provocations," according to the state-run Korean Central News Agency.

How the breach happened

Binance's early read was that the attack ran through an engineer's compromised laptop, which let an attacker reach a service container and submit unauthorized withdrawals. Co-CEO Richard Teng said it was a "complex attack" and not a "one-click" action, and that malicious software was built to erase its own traces.

Binance's own incident report goes further back, according to FinanceFeeds. It traces the breach to June, when a wallet engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool. On Oct. 20, attackers used an internal AI tool to move onto two more engineers' machines. Binance has also said it blocked 57 suspected North Korea-linked attacks before this one succeeded.

The AI angle is easy to overstate. JP Schnapper-Casteras of the Atlantic Council wrote that there is no public evidence AI tools were used to break into Binance's systems. He pointed to compromised credentials and trusted access as familiar weaknesses. After the theft, Chainalysis identified thousands of transactions moving funds repeatedly among wallets. Schnapper-Casteras said that pattern suggests automation, not necessarily AI agents.

Customers paid, money not recovered

Binance said on Oct. 31 that it had enough on hand to cover 90% of the stolen value. The rest are less liquid tokens that take longer to buy back. The money came from its $1 billion bitcoin reserve in the Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury. The company said it will refill the reserve to roughly $1 billion.

By Sunday, Nov. 1, Binance said it had replaced nearly all of the lost assets, and most customers could withdraw again. Schnapper-Casteras puts the replenished share at about 95% and notes that is not the same as recovering 95% of the money from the hackers.

The recovery side is smaller. A group of crypto firms froze about $3 billion of the stolen funds in the hours after the attack. That leaves roughly half the haul, by Binance's own figure of $6.3 billion, in play.

Ari Redbord, a policy executive at TRM Labs, which has helped Binance trace funds, expects the hackers to split the assets into pieces and push them through smaller exchanges, a process that could run for months. "It's bank robbery, in this case, at the speed of the Internet," he said. "However, we can also track and trace those funds in real time."

Background on Binance

Binance was co-founded in 2017 by Changpeng Zhao and Yi He. Zhao pleaded guilty in the United States in 2023 to failing to maintain an effective anti-money-laundering program, served four months in prison for violating the Bank Secrecy Act and was pardoned by President Donald Trump last year.

How much of the unfrozen money TraderTraitor can actually cash out remains unclear. The FBI has asked exchanges and analytics firms to block the listed addresses, and the laundering attempts it says it expects will test that request in the coming weeks.