Secret Service Joins Binance Hack Recovery as Exchange Reserves $6.34 Billion for Repayments

Since Binance disclosed on Oct. 29 that roughly $6.3 billion left its wallets, the response has widened from the exchange and a handful of stablecoin issuers to federal law enforcement and a detailed on-chain reconstruction of how the theft unfolded.

Secret Service and FBI in the case

The U.S. Secret Service confirmed today, Oct. 30, that it is working with Circle to claw back stolen funds, according to Crypto Briefing. A person familiar with the matter told Reuters that Binance is cooperating with the FBI, the Secret Service and law enforcement agencies worldwide.

The FBI said in a statement that it "is aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps."

The Secret Service has a financial crimes mandate that dates to its origins chasing counterfeit currency. Neither agency has publicly named a suspect.

Binance sets aside $6.34 billion

Binance has reserved more than $6.34 billion to cover the losses, according to the exchange's disclosures. It says it will pay from its Secure Asset Fund for Users, known as SAFU, and from company funds.

The exchange says it plans to repay users in the same tokens they lost. A customer who held Bitcoin should get Bitcoin back, not a cash equivalent.

Binance co-founder Yi He said deposits are unaffected and that withdrawals should begin resuming within 48 hours while the exchange reworks its withdrawal security and address controls. The exchange has also promised an updated Proof of Reserves once remediation is complete.

Changpeng Zhao, who founded Binance, resigned after his 2023 guilty plea to Bank Secrecy Act violations and received a presidential pardon from President Donald Trump last year. He said on Oct. 29 that he no longer runs the exchange but remains a shareholder, and that he expects users to be made whole.

What the on-chain trail shows

The drain began around 4 p.m. ET on Oct. 29, and most of the money moved in about 20 minutes, according to blockchain analytics firm TRM Labs. Binance wallets on at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana, were emptied into addresses controlled by a single attacker.

TRM says preparation started at least 36 hours earlier. One attacker wallet received three small withdrawals during a test period, the firm said. Early on Oct. 29 the operator tested a first piece of code on two wallets, then rehearsed the final version on a third and routed the test funds back to itself.

"Four hours after that rehearsal, the same code was installed on a Binance hot wallet," TRM said.

A separate timeline built from on-chain data puts the key steps in UTC. The attacker's relayer wallet was funded through three 0.1 ETH Tornado Cash withdrawals. A malicious contract was deployed at 15:59, and an EIP-7702 authorization installed the code on a major Binance Ethereum hot wallet around 20:21. A single "sweep" call emptied that wallet at 20:24.

Another Binance wallet sent 28,005 ETH to the same address within 24 seconds. The attacker then pulled 780 million USDC from a third hot wallet.

Binance says it found no evidence of a wallet private key leak. An on-chain analyst known as 0xQuit noted that the attacker used a relayer wallet, which suggests signing access through Binance's own systems rather than stolen keys.

How far the money can be stopped

Binance says about $3 billion is frozen on-chain. Tether CEO Paolo Ardoino said his company froze more than 1.567 billion USDT. Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC.

Most of the frozen sum is stablecoins, because Circle and Tether issue their tokens centrally and can blacklist addresses. Bitcoin and Ether have no issuer and cannot be frozen that way. That leaves roughly half the stolen total outside the reach of any freeze.

Attribution remains private-sector

TRM Labs and Chainalysis both point to North Korea's TraderTraitor unit. TRM says it makes that judgment "with high confidence," citing features shared with the Bybit heist, which the FBI put at $1.5 billion in 2025. Chainalysis CEO Jonathan Levin said the hack was "likely done" by the group.

Elliptic is more cautious. Co-founder Tom Robinson said, "We think North Korea is likely responsible," but said Elliptic has not tied the theft to TraderTraitor specifically, only seen overlaps in the activity. He added that if North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.

Neither Binance nor the agencies leading the case have confirmed a North Korean link. Binance has not said who it believes is responsible and says it is working with law enforcement "to confirm the identity of these criminals."

The cause of the breach is also still shifting. Binance first said a compromised DevOps engineer's laptop gave an attacker access to a service container that could submit unauthorized withdrawals. Co-CEO Richard Teng later said the attack involved a more complex process than one engineer's permissions, and Binance has since referred to additional "points of breach."

What comes next

Binance has said it will publish a detailed technical post-mortem once the facts are fully verified. That document, along with the updated Proof of Reserves and the resumption of withdrawals within the 48-hour window Yi He gave, are the next concrete checkpoints. Until then, how the attacker got signing access remains an open question.