President Donald Trump said on Friday that he is looking into the hack of Binance, and, according to Bloomberg, is weighing whether North Korea was behind the attack. The theft, which Binance has confirmed as the largest in crypto history, has drawn in two federal agencies and a federal prosecutor's office, revived a fight in Washington over crypto freeze powers, and produced competing private attributions from blockchain analytics firms.

Trump made the comment at a press conference, adding that Binance had said it was making sure customers get their funds back, The Block reported.

“But it’s a hack. That’s the problem,” he said, comparing crypto with the old way of signing a check. With crypto, he said, the money goes to people you never see, which is why he had always felt it was a little dangerous.

The episode also touches Trump in other ways. Binance founder Changpeng Zhao pleaded guilty in 2023 to failing to maintain adequate anti-money-laundering controls as part of a $4 billion settlement, and Trump later pardoned him. Trump-linked World Liberty Financial froze about $27 million of its USD1 stablecoin tied to the hack, Binance co-founder Yi He said, as Coindoo reported in its running coverage of the incident.

What the agencies have said

The FBI told Nextgov on October 30 that it was working with public and private partners to understand the scope of the incident, assess its potential impact and coordinate investigative steps. Nextgov noted that the bureau did not attribute the intrusion to North Korea.

The Secret Service described its own early-stage investigation. According to the BBC's live coverage, the agency is working with private-sector partners to identify, freeze, trace and recover the stolen funds, and is coordinating with the US Attorney's Office for the District of Columbia. With two federal agencies and a federal prosecutor's office involved, the case is being handled as a criminal matter as well as a security incident.

The Bitget connection

The new detail in the private attributions comes from Chainalysis. Besides pointing to TraderTraitor — the North Korean group that TRM Labs, which valued the theft at $6.36 billion, named with high confidence — the firm found that funds stolen from Binance mixed onchain with proceeds from last month's Bitget theft, which had already been attributed to North Korean actors. Chainalysis said the overlap in the money trail strengthened its assessment.

Elliptic sees the same overlapping laundering infrastructure but adds that professional laundering networks often work for more than one client. Money from two thefts passing through the same channels shows they share a laundering route; it is weaker evidence that the same team broke into both exchanges.

A fight over who can freeze what

In Washington, the hack has reopened the debate over crypto rules. Commodity Futures Trading Commission Chair Michael Selig said on CNBC that the real problem is unregulated offshore exchanges without the safeguards of US markets, pointing to the framework his agency proposed on October 5 for leveraged retail crypto trading.

The sharpest exchange centered on the Clarity Act, the broad market-structure bill that passed the House last year but has stalled in the Senate, partly over concerns about Trump's crypto wealth.

Sen. Cynthia Lummis, R-Wyo., argued that the bill would have given crypto firms legal cover to freeze suspicious transactions the moment law enforcement calls.

Amanda Fischer of Better Markets replied that the bill would have required stablecoin issuers to freeze under a court order, and that firms already froze assets as fast as they could.

Patrick Wilson of the Solana Policy Institute countered that a section of the bill protected issuers from lawsuits over voluntary, temporary holds, with no court order needed.

Industry groups are pushing too. The Digital Chamber's chief executive, Cody Carbone, wrote to House and Senate leaders on Friday urging them to pass a bill before Congress adjourns that would give the CFTC authority over crypto exchanges and keep customer funds separate from company funds in bankruptcy. Rep. Tom Timmons, R-S.C., framed the theft as a national security issue, warning against rogue regimes using digital assets to fund weapons programs.

What official attribution looked like last time

The Bybit case shows the form an official answer takes. The FBI's notice named the country, named the activity and warned that the stolen assets were being laundered across thousands of addresses. No such notice has been published for Binance yet. Until one appears, the analytics firms' reports remain the fullest public account of who was behind the theft, and any eventual notice would show whether the government's assessment lines up with them.

Still open

How did the attacker get in? Binance first pointed to a compromised engineer's laptop. Co-CEO Richard Teng has since described additional breach points, according to the BBC, so the full technical account is still to come.

How much comes back? About $3 billion has been frozen — less than half the amount TRM Labs says was taken — but frozen funds are not yet returned funds, and the attacker has been converting freezable stablecoins into assets such as ETH, as Coindoo traced in its look at how the hacker borrowed against stolen USDT.

This article is provided for informational purposes only and does not constitute financial or investment advice.