A reported $6.3 billion breach at Binance has exposed a rift at the center of US crypto regulation: the Commodity Futures Trading Commission (CFTC) and at least one member of Congress are pointing to sharply different remedies, raising the question of which institution will shape the regulatory response to large-scale exchange hacks going forward.

What Is Known About the Reported Breach

According to reporting by Bitcoin.com News, the breach at Binance resulted in reported losses of $6.3 billion — a figure that has not been independently confirmed by Binance or by US regulators. The scale of the alleged loss is what drew formal attention from both the CFTC and Capitol Hill.

The incident triggered immediate market pressure. Bitcoin fell below $77,000 and BNB dropped in the wake of the reported hack, illustrating how quickly security events at major exchanges translate into broader market stress. On-chain observers also noted that funds tied to the breach moved through THORChain, complicating any recovery or freeze effort. THORChain is a decentralized cross-chain liquidity network that swaps assets between blockchains through liquidity pools operated by independent node validators rather than a single custodian — one reason transfers routed through it resist the freeze-and-recover playbook that applies to assets held in a centralized venue.

Because the $6.3 billion figure originates from a single report and Binance has not issued a formal disclosure matching that amount, any regulatory action taken in response is, at least in part, a reaction to an unverified claim. That ambiguity sits at the heart of why two parts of the US regulatory apparatus are reaching different conclusions.

The CFTC's Rulemaking-Based Response

The CFTC, which holds jurisdiction over derivatives and certain spot commodity markets in the United States, has approached the reported breach through the lens of its existing rulemaking authority. The agency's response centers on whether Binance's operational structure — including its custodial practices and risk management protocols — falls within the reach of CFTC oversight frameworks such as Regulation CTX and Regulation CAM, two proposed rule sets that would establish conduct and market integrity standards for digital asset intermediaries.

The agency's institutional instinct is to treat the hack as a compliance and supervision failure, one addressable through enhanced rulemaking rather than emergency legislation. From that perspective, the CFTC's answer to the breach is more rulemaking and stronger enforcement of existing conduct standards — not a new statutory framework.

The CFTC also has a recent precedent for acting against Binance: in March 2023 the agency sued Binance and founder Changpeng Zhao over an unregistered derivatives business serving US customers, a case resolved in November 2023 with the company agreeing to pay a $2.7 billion civil penalty and Zhao $150 million. Binance.US and Blockchain.com have separately sought CFTC approval to offer prediction markets — event contracts that fall under the agency's derivatives jurisdiction — a sign that the agency is already embedded in Binance's US regulatory relationships. That ongoing engagement gives the CFTC leverage to push for compliance reforms without waiting for Congress to act.

Why a US Lawmaker Sees a Different Path

The unnamed US lawmaker cited in the reporting takes a different view. Where the CFTC frames the event as a regulatory compliance problem, the lawmaker's position, as described by Bitcoin.com News, treats the breach as evidence that existing agency authority is structurally insufficient to protect consumers at offshore exchanges that serve US customers.

The legislative argument, in broad terms, is that a rule change administered by a single agency cannot close the accountability gap exposed by a $6.3 billion loss at an exchange operating outside direct US jurisdiction. The lawmaker's preferred path appears to involve statutory intervention — a new law rather than an agency rule — that would impose minimum security and disclosure standards on any platform serving US users, regardless of where it is incorporated. That jurisdictional gap is the same terrain the CFTC's 2023 case against Binance covered, which ended in a negotiated settlement rather than a definitive court ruling on how far US law reaches into offshore platforms serving American users.

The tension between the two positions is not new in US financial regulation. Administrative rulemaking is faster and more flexible; statutory mandates are harder to challenge and harder to ignore. For exchanges like Binance, the difference is significant: an agency rule can be contested in court or delayed through comment periods, while a law passed by Congress carries different weight and different compliance timelines.

Unresolved Questions for Markets and Users

What remains unresolved is whether the two approaches are mutually exclusive or complementary. The CFTC could advance its rulemaking while Congress debates a statutory framework, leaving Binance and other large offshore exchanges facing potentially overlapping obligations on different timelines.

For traders and investors, the more immediate question is how each path affects accountability for losses. An agency rule typically creates enforcement mechanisms for future conduct; a law can, in principle, establish liability standards that apply retroactively or create private rights of action for harmed users. Those distinctions matter enormously if the $6.3 billion figure is eventually confirmed and affected users seek recourse. Losses of this scale at custodial platforms have historically renewed the debate over how much counterparty risk users accept by keeping assets on an exchange — a question that runs alongside, but does not replace, the liability and recovery issues raised by the two regulatory tracks.

Readers should watch for three developments: any formal CFTC enforcement notice related to the breach, any legislative text introduced in response to the hack, and whether Binance issues a public statement that either confirms or disputes the reported loss figure. Until at least one of those occurs, both the CFTC's position and the lawmaker's proposal remain responses to an event whose full dimensions are still unverified.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.