- Trending
- Comments
- Latest
Binance founder Changpeng Zhao has thanked the U.S. Secret Service for helping freeze funds within minutes of the $6.3 billion hack on October 29. The FBI has since blamed North Korea’s TraderTraitor group, while industry partners reportedly froze about $3 billion.
The development follows a November 1 announcement by the Secret Service confirming that investigators had secured a significant portion of the stolen cryptocurrency and were continuing efforts to trace the remaining assets.
The coordinated response involves several federal agencies and private-sector cryptocurrency companies working to prevent the movement and laundering of stolen digital assets.
The U.S. Secret Service confirmed that its investigators began coordinating with cryptocurrency industry partners shortly after the October 29 security breach.
According to the agency, the rapid response enabled investigators to identify and freeze a significant portion of the affected digital assets before they could be transferred further.
Although the Secret Service did not disclose the exact amount frozen during its initial intervention, it confirmed that recovery efforts were continuing.
The agency’s response involved cooperation with the Federal Bureau of Investigation, Internal Revenue Service Criminal Investigation, and several divisions of the Department of Justice.
The U.S. Attorney’s Offices for the District of Columbia and Central District of California are also participating in the investigation.
Other agencies involved include the Justice Department’s Computer Crime and Intellectual Property Section and National Security Division.
Together, the agencies are working to identify wallets associated with the attackers, trace suspicious transactions, and prevent additional transfers of stolen cryptocurrency.
Zhao, widely known as CZ, acknowledged the authorities’ involvement in a November 2 post on X.
“Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets,” — Changpeng Zhao, Founder of Binance.
His remarks emphasized the importance of cooperation between law enforcement authorities and private cryptocurrency companies during major security incidents.
The Binance hack prompted an extensive response across the digital asset industry, with exchanges, stablecoin issuers, and blockchain intelligence firms working to restrict access to compromised funds.
Binance previously estimated that approximately $6.3 billion in cryptocurrency assets had been affected by the attack.
Industry partners reportedly froze around $3 billion in stolen assets, although that figure should not be interpreted as the amount secured independently by the Secret Service.
The distinction remains important because the agency has not provided a separate financial breakdown of its initial intervention.
The FBI officially attributed the cryptocurrency theft to North Korean hackers operating under the name TraderTraitor.
In an October 31 announcement, the agency stated that the Democratic People’s Republic of Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29.
The attribution marked a significant development in the investigation, shifting attention toward the activities of a state-linked cybercrime operation.
According to the FBI, investigators working alongside the Secret Service and IRS Criminal Investigation observed the attackers converting stolen cryptocurrency primarily into Ethereum.
Authorities expect the perpetrators to continue laundering the assets through decentralized finance protocols and instant cryptocurrency exchange services.
These platforms allow users to exchange digital assets without necessarily relying on conventional centralized trading infrastructure.
The FBI warned that the movement of stolen funds through such services could complicate efforts to identify the individuals controlling the cryptocurrency.
As part of its response to the Binance hack, the agency published a list of Ethereum wallet addresses believed to be operated by or closely associated with TraderTraitor actors.
Some of the addresses reportedly held stolen assets, while others had previously received funds connected to the breach.
Federal investigators urged cryptocurrency businesses and infrastructure providers to prevent transactions involving the identified wallets.
The appeal specifically targeted THORNode operators, RPC node operators, instant exchanges, decentralized finance services, blockchain analytics companies, and other virtual asset service providers.
The FBI also encouraged individuals with information about the theft to contact their local field office or submit reports through the Internet Crime Complaint Center.
The attribution follows broader findings from blockchain analytics firm Chainalysis, which linked North Korean hackers to approximately 89% of cryptocurrency theft losses recorded during 2026.
The latest incident also exceeds the approximately $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025.
The scale of the Binance hack has consequently placed renewed attention on the threat posed by sophisticated cybercriminal organizations targeting major cryptocurrency platforms.
Separate blockchain analysis has provided additional insight into how quickly the stolen cryptocurrency moved following the attack.
Blockchain intelligence firm TRM Labs estimated that the perpetrators transferred approximately $6.36 billion in digital assets across ten blockchain networks.
According to the firm’s findings, most of the funds moved within roughly 20 minutes of the initial breach.
The rapid transfers created considerable challenges for investigators seeking to identify affected wallets and prevent further movement of the assets.
Cryptocurrency transactions can be recorded and examined on public blockchains, but assets may pass through multiple addresses, networks, and exchange services before investigators can restrict them.
The reported movement of funds also highlights why coordination between blockchain analytics companies and cryptocurrency service providers was critical during the early response.
Investigators have continued tracing the stolen assets through various wallets while requesting assistance from exchanges and other industry participants.
The Binance hack also demonstrated the importance of rapid action by stablecoin issuers and other service providers capable of restricting transactions involving particular digital assets.
While some cryptocurrency tokens can be frozen by their issuers, other assets, including native Ethereum, do not have an equivalent centralized freezing mechanism.
Consequently, investigators must coordinate with different participants across the cryptocurrency ecosystem to limit the movement of stolen funds.
The FBI’s identification of wallet addresses linked to TraderTraitor provides exchanges and blockchain service providers with information that can support transaction monitoring and restrictions.
However, identifying suspicious transactions does not automatically guarantee that all affected assets can be recovered.
The final recovery amount will depend on how successfully investigators trace the remaining cryptocurrency and prevent additional laundering activity.
Binance has maintained that customers affected by the security breach will receive compensation through a combination of company resources and its Secure Asset Fund for Users.
The exchange’s preliminary investigation indicated that the attackers may have gained unauthorized access after compromising a DevOps engineer’s laptop.
According to Binance, the incident potentially allowed access to an internal service container used to submit unauthorized cryptocurrency withdrawal transactions.
The exchange reported that investigators had found no evidence that customer wallet private keys were leaked.
Following the discovery, Binance revoked the affected authorization and temporarily restricted withdrawals while conducting additional security checks.
The company also engaged law enforcement agencies and blockchain intelligence firms to assist with tracing the stolen assets.
The Binance hack had immediate consequences for cryptocurrency markets, with Bitcoin and several major altcoins declining as liquidation activity exceeded $1.5 billion on October 30.
The market reaction reflected heightened concerns about exchange security and the potential financial consequences of one of the largest cryptocurrency thefts on record.
Binance has pledged to cover customer losses using its insurance fund and company resources.
However, the ultimate financial burden will depend partly on the amount of stolen cryptocurrency authorities and industry partners successfully recover.
The exchange has also continued security assessments and service restoration efforts across affected networks.
Meanwhile, federal investigators are working to identify additional wallets and transactions associated with the attackers.
The ongoing investigation underscores the role of cooperation between centralized cryptocurrency platforms, blockchain analytics providers, stablecoin issuers, and law enforcement authorities in responding to major digital asset thefts.
Although the Binance hack resulted in billions of dollars in reported losses, Zhao’s acknowledgment of the Secret Service highlights the significance of the initial response in restricting the movement of affected assets.
With North Korean TraderTraitor hackers identified by the FBI and recovery efforts continuing, authorities remain focused on tracing the remaining cryptocurrency and preventing further laundering.
The eventual outcome will depend on the effectiveness of those investigations, the ability of service providers to restrict suspicious transactions, and Binance’s commitment to compensate affected customers.
Copyright © 2025 - The Bit Gazette.
