The record-breaking hack of Binance is exactly why offshore crypto exchanges need U.S. oversight, Commodity Futures Trading Commission (CFTC) Chairman Michael Selig argued, using the roughly $6.4 billion theft to press the agency's case for a federal rulebook.

Speaking to CNBC on Friday, Selig said the breach “proves our exact point” behind the crypto-market regulations the agency proposed earlier this month.

“The real issue here is that these are unregulated offshore exchanges, and they don’t have the same sorts of safeguards that we have in our financial markets here in the United States,” he said, pitching a “federal option” that would let such venues register with the CFTC and submit to the same cybersecurity standards that govern U.S. markets.

A laptop, not a blockchain flaw

Selig sought to downplay the role of blockchain technology itself in the attack. The exploit, he said, did not break the underlying blockchain—in this case, Ethereum—or its smart contracts, but rather exploited a vulnerability he believed was “introduced from someone’s laptop,” the kind of security lapse that also happens in traditional markets.

The difference with crypto, he said, is speed: stolen funds can move far faster than in conventional finance, and attackers can route them through tools like Tornado Cash to obscure their trail.

Selig's characterization, however, may be incomplete. Binance initially attributed the breach to a compromised DevOps engineer’s laptop, but said Friday that its ongoing investigation had since uncovered “additional points of breach,” with CEO Richard Teng describing it as “a more complex attack process” that “did not simply use one engineer's permissions.”

And while the theft did not expose a flaw in Ethereum itself, the attack did play out partly on-chain: the attacker used EIP-7702, an Ethereum feature that lets ordinary wallets run smart-contract code, to turn a Binance hot wallet—an internet-connected wallet used for day-to-day withdrawals—into a “sweeper” using 50 pre-signed authorizations, draining its assets.

Blockchain analytics firm TRM Labs said the broader breach points to a compromise of Binance's signing infrastructure rather than a weakness in any blockchain. That finding matters for the policy fight: it locates the failure in exchange operations—the layer a federal registration regime would regulate—rather than in blockchain code.

Transparency as a regulatory tool

Selig framed the blockchain's transparency as a regulatory advantage regardless. “The fact that we can trace transactions on-chain, even when some of these technologies are used to obfuscate that, gives regulators a lot of potential to be really cop on the beat here,” he said.

The comments sharpen a regulatory pitch Selig has been making for weeks. The CFTC has pressed ahead with its own crypto rulemaking rather than wait on Congress, sending the White House proposals that would define event contracts as “swaps” and floating a plan to bring crypto exchanges under federal oversight—part of a broader shift in which regulators have taken the lead on digital-asset policy after the Clarity Act stalled in the Senate. Whether the White House acts on those proposals, and whether the Senate revisits the Clarity Act, now count among the key markers for the oversight push.

The Binance hack hands that effort a vivid talking point. The exploit is the largest in crypto history, with Binance setting aside $6.34 billion to cover losses and assuring users their assets are safe. The U.S. Secret Service and the FBI have opened a probe into the theft, and blockchain analytics firms TRM Labs and Chainalysis have tied it to North Korea’s TraderTraitor group. Binance's investigation remains ongoing, and whether on-chain tracing can follow funds routed through obfuscation tools like Tornado Cash will be among the developments to watch as the federal probes proceed.