Federal Reserve and Office of the Comptroller of the Currency (OCC) supervisors began phoning U.S. banks this week to check whether their systems had shown any signs of compromise following the $6.3 billion hack of Binance. The outreach began on Monday, November 2 — the same day a new rule from the OCC and the Federal Deposit Insurance Corporation (FDIC) took effect that narrows the circumstances in which examiners can force banks to fix cybersecurity flaws.

Regulators check bank systems for vulnerabilities

Supervisors from the Federal Reserve and the OCC began phoning banks that day, asking whether they had experienced any service disruptions or anything out of the ordinary on their systems. Several people familiar with the outreach described the calls to Reuters.

One bank that took a call reported no interruptions. Its staff had drawn up talking points to use with customers but ended up fielding only a few questions. Binance said it knew nothing of the exchanges between bankers and regulators, but stated that it is keeping regulators around the world up to date on the security breach.

New rule raises the bar for forced remediation

The rule, adopted by the OCC and FDIC on August 27 and published in the Federal Register on September 1, took effect on November 2. It sets out, for the first time in regulation, what counts as an “unsafe or unsound practice,” according to the FDIC, and it makes it harder to issue a matter requiring attention (MRA) — the formal written notice examiners use to tell a bank it must fix a problem.

Under the new standard, examiners must link the weakness to likely serious harm to the bank's finances or to an actual violation of law. Problems that fall short of that test become supervisory observations, which come with no action plan, are not tracked as formal findings, and do not have to be shared with the board.

The Federal Reserve did not sign on to the rule, so banks it oversees are not covered; the Fed has instead pursued a similar standard through internal policy. The OCC kept a separate power to force banks to fix serious security weaknesses even when there is no link to the bank's finances, while the FDIC said it would use that power only rarely, and only under the same strict standard. The split traces back to the structure of U.S. bank supervision: the OCC charters and oversees national banks, the Fed supervises state member banks and bank holding companies, and the FDIC oversees state-chartered banks that are not Fed members — so the same kind of cybersecurity weakness can land under different regimes depending on who supervises a given bank.

Banks probe their own defenses

Banks have reportedly been dissecting the Binance hack and running diagnostics on their own systems to determine whether they could withstand a similar attack. Within hours of the theft, a security team at one of the largest U.S. banks contacted its counterparts at Binance. The team is now writing an internal report that, according to one source, could lead to a review of the bank's systems and possible cybersecurity updates. The speed at which AI models are improving makes it harder for banks to stay ahead of attackers, and banks have reportedly begun pouring resources into reviews and code patches.

How the $6.3 billion Binance hack unfolded

Cryptopolitan previously reported that roughly $6.3 billion was drained from the exchange in the October 29 incident, which is regarded as the largest crypto theft on record. In its incident report, Binance said the attack began in June, when a wallet engineer installed a tampered AI coding tool, and escalated in September after a second engineer downloaded malicious code following a fake job interview. Both entry points — a compromised developer tool and malware delivered through a bogus hiring process — fit well-documented intrusion categories: software supply-chain compromise and social engineering. The attackers later used an internal AI tool with stolen credentials to gain access to the exchange's wallets, according to Cryptopolitan's earlier reporting.

The FBI blamed North Korea's TraderTraitor group in an October 31 alert, a claim Pyongyang rejected. Binance co-CEO Richard Teng said the exchange had replaced about 95% of the stolen funds from its own reserves and remained financially sound. From here, the immediate items to watch are Binance's ongoing updates to regulators worldwide, which it has said are continuing, and the results of the diagnostics and internal reports banks have begun in response to the theft.