Binance founder Changpeng Zhao has publicly thanked the U.S. Secret Service and other federal agencies for their role in freezing cryptocurrency stolen in last week's attack on the exchange, which resulted in the loss of more than $6 billion and now ranks among the largest hacks in crypto history.

The attack took place on October 29. Binance has estimated that about $6.3 billion in cryptocurrency was affected in the incident, and industry partners have so far frozen roughly $3 billion of the stolen assets.

Blockchain intelligence firm TRM Labs offered a slightly higher figure, estimating that the attackers moved approximately $6.36 billion across 10 blockchain networks, with the majority of the transfers completed within roughly 20 minutes. The pace of the transfers illustrates the core challenge in crypto theft cases: once assets are dispersed across multiple chains and converted through swap services, freezing them becomes far more difficult.

Secret Service Confirms Funds Frozen

In a post published on X on November 1, the U.S. Secret Service confirmed that its investigators, working alongside partners from the crypto industry, had identified and frozen a significant portion of the stolen assets within minutes of the incident taking place.

The U.S. Secret Service continues to investigate the theft of more than $6 billion in cryptocurrency from Binance Global. Within minutes of the incident on Thursday afternoon, Secret Service investigators worked with industry partners to identify and freeze a significant portion… pic.twitter.com/A9j6wFnYZl

— U.S. Secret Service (@SecretService) November 1, 2026

The Secret Service, whose mandate covers investigating financial crime, did not disclose the exact amount of funds it secured. The agency said that work to recover the remaining assets is ongoing, and that investigators continue to trace the stolen cryptocurrency through multiple wallets. With roughly $3 billion frozen so far against a stolen total estimated at more than $6 billion, further freezes and seizures will be the clearest signal of how the recovery effort progresses.

The wider effort includes the FBI, IRS Criminal Investigation, and the U.S. Attorney's Offices for the District of Columbia and the Central District of California. The Department of Justice's Computer Crime and Intellectual Property Section and its National Security Division are also participating in the investigation.

FBI Attributes Theft to North Korean Hackers

On October 31, the FBI said North Korean hackers known as TraderTraitor were responsible for carrying out the theft. TraderTraitor is the label U.S. agencies have used for a cluster of North Korean state-linked cyber groups that specialize in cryptocurrency theft — activity United Nations investigators have previously identified as a major revenue source for the North Korean state. Investigators have observed the attackers converting the stolen assets mainly into Ethereum, and the bureau expects the hackers to continue laundering the funds through decentralized finance protocols and instant swap services. These services allow users to trade digital assets without going through a traditional centralized exchange.

Authorities have asked node operators, instant exchanges, DeFi services, and blockchain analytics firms to block transactions tied to the theft. The FBI has also published a list of Ethereum addresses linked to the attackers.

Chainalysis has linked North Korean hackers to about 89% of all cryptocurrency theft losses recorded in 2026. With an estimated haul of more than $6 billion, the Binance attack now ranks among the largest crypto hacks on record, surpassing the roughly $1.5 billion stolen from Bybit in February 2025.

How the Breach Unfolded

Binance's early investigation suggests that the attackers may have compromised a DevOps engineer's laptop, an access path that could have given them the ability to use an internal service responsible for sending withdrawal transactions. The exchange said it found no evidence that wallet private keys were leaked. It revoked the affected access and paused withdrawals while it carried out security checks.

The hack hit crypto markets quickly. Bitcoin and major altcoins fell, and liquidations — the forced closures of leveraged trading positions — topped $1.5 billion on October 30.

Binance said affected users will be covered for their losses. The exchange plans to draw on company resources and its Secure Asset Fund for Users, an emergency insurance reserve, though the final cost of the incident will depend on how much of the stolen funds is ultimately recovered.

The FBI has asked anyone with information about the attackers or transactions related to the stolen funds to contact a local field office. Tips can also be submitted through the bureau's Internet Crime Complaint Center.

Zhao Thanks Responding Agencies

In a November 2 post on X, Zhao said the agencies and industry partners had responded within minutes of the attack.

"Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets," Zhao wrote.

This article is based on reporting by Blockonomi.