Binance is cooperating with the FBI and the U.S. Secret Service after hackers stole $6.4 billion from the cryptocurrency exchange, according to Reuters. Circle has frozen approximately $823 million in USDC connected to the attack, while Tether has frozen between $975.1 million and more than $1.5 billion in USDT, according to separate figures reported by the companies and their executives.

A person familiar with the matter told Reuters that Binance was cooperating with law enforcement agencies around the world, including both U.S. agencies. The FBI confirmed that it was aware of the incident and was working with public- and private-sector partners to assess its scope and coordinate investigative steps. The Secret Service has not publicly commented.

Investigating financial crimes is part of the Secret Service’s responsibilities, in addition to its better-known role protecting the president. The agency, created in 1865 to combat currency counterfeiting, also investigates computer crimes, unauthorized access to computer systems and crimes involving digital currencies.

Circle, the company behind USDC, a stablecoin designed to maintain a value of $1, separately confirmed that it was coordinating with law enforcement. Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC associated with the Binance incident and would continue supporting the investigation.

Tether, which issues the competing USDT stablecoin, said it had frozen more than 1.567 billion USDT related to a potential Binance exchange hack. In an X post, Tether CEO Paolo Ardoino wrote:

Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone. — Paolo Ardoino 🤖 (@paoloardoino) October 29, 2026

https://x.com/paoloardoino/status/2115918000373346709?ref_src=twsrc%5Etfw

Both Circle and Tether can blacklist specific blockchain addresses, preventing the tokens they issue from being transferred out of those wallets. This gives stablecoin companies an unusual role in crypto investigations because they can immobilize stolen funds before investigators identify the people responsible.

The FBI and Secret Service involvement follows an increasing number of attacks attributed to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis have both linked the $6.3 billion theft to TraderTraitor, a hacking group associated with North Korea’s cyber operations. The group was previously linked to the $1.5 billion Bybit hack in February 2025, which the FBI also attributed to North Korean hackers and which at the time was the largest cryptocurrency theft on record.

North Korean attackers have targeted Binance before, including attempts to infiltrate the exchange by posing as job applicants. In a 2025 interview with Decrypt, Binance Chief Security Officer Jimmy Su said North Korean operatives contacted employees on LinkedIn every day and sometimes used fake interviews to deliver malware to their devices.

This is not the first time the Secret Service has worked with cryptocurrency companies to investigate digital-asset crimes. In April, Operation Atlantic—a joint effort involving the Secret Service, the U.K.’s National Crime Agency, Binance, Coinbase and other crypto firms—identified more than 20,000 victims of approval-phishing scams, traced $45 million in stolen funds and froze $12 million.

Binance has said it will cover all losses using company funds and its Secure Asset Fund for Users, an emergency reserve intended to protect customers in the event of a security breach. CEO Richard Teng said on Friday that the company had reserved more than $6.34 billion to cover the stolen assets, while approximately $3 billion had already been located or frozen with help from industry partners.

The exchange initially suspected that a compromised laptop belonging to a DevOps engineer had given the attackers access to its systems. Binance has since identified additional points of breach and said it found no evidence that wallet private keys had been leaked. Withdrawals remain suspended while the exchange reviews its security infrastructure, with Binance targeting a resumption by Sunday.

Reuters: