FBI and U.S. Secret Service Step In After Binance $6.3B Hack

The FBI and the US Secret Service have confirmed they are working with Binance after the exchange disclosed a $6.3 billion hack, as investigators and blockchain analytics firms try to trace and recover stolen cryptocurrency.

According to Reuters, the FBI said it is coordinating with government and industry partners to assess the incident’s scope, potential impacts, and investigative steps. Separately, a Secret Service spokesperson told Bloomberg that investigators are working “around the clock” with private-sector partners to recover stolen funds.

Key takeaways

• The FBI and Secret Service are actively coordinating on the Binance hack response, focusing on incident scope and recovery efforts.
• Binance says it has reserved more than $6.34 billion in company funds to cover losses, including $5 billion held in affected cryptocurrencies.
• Withdrawals remained suspended as of Friday, with plans to restart in stages from Sunday after security checks.
• Blockchain intelligence firm TRM Labs attributed the attack to North Korea’s TraderTraitor group.
• Binance is signaling an emphasis on proof-of-reserves transparency, expected Monday, while funds tracing continues.

Law enforcement steps up alongside private-sector recovery

The acknowledgements from US agencies add weight to the operational response already underway by Binance and outside experts. Reuters reported that the FBI is coordinating with “government and industry partners” to evaluate the attack’s scope and to align next steps. Bloomberg’s reporting indicates Secret Service investigators are prioritizing recovery, working in parallel with private-sector partners.

For users and institutional counterparties, the involvement of federal investigators matters because it can accelerate the information flow needed for effective tracing—especially once stolen assets move through multiple on-chain services and exchange counterparts. It also increases pressure for rapid, coordinated action across the ecosystem to identify tainted funds and limit further monetization.

Binance’s internal cover and the status of withdrawals

Binance said it has set aside more than $6.34 billion from company reserves to address losses stemming from the hack, including $5 billion already held in the affected cryptocurrencies. A spokesperson told Cointelegraph that those tokens were in Binance’s custody, while declining to share wallet addresses, citing security concerns.

At the same time, Binance maintained a withdrawal suspension during the ongoing investigation. In its plan, the exchange said it intends to begin reopening withdrawals in stages from Sunday, subject to security checks. Binance also indicated that proof-of-reserves results are expected Monday, a move likely aimed at reinforcing confidence that customer liabilities can be met while stolen-funds remediation continues.

Binance also indicated its cooperation with law enforcement in a Friday X post, though it did not specify which agencies were involved. The post did not add operational details beyond confirming ongoing collaboration.

What TRM Labs says about attribution—and why it matters

Blockchain intelligence firm TRM Labs attributed the attack to North Korea’s TraderTraitor group. Such attribution, when backed by on-chain and behavioral indicators, can influence how investigators and market participants approach blocking or tracking assets across jurisdictions and compliance frameworks.

However, readers should note that attribution typically evolves as investigations expand. What matters in the near term is whether the stolen flows can be reliably identified and whether exchanges, custody providers, and other counterparties can act quickly on those indicators to reduce the stolen assets’ ability to circulate.

Liquidity strain and system-level context

While law enforcement coordination progresses, Binance’s scale continues to shape the broader market’s operational stress. Binance is described as the largest cryptocurrency exchange by reserves, with $134 billion in total assets. In the 24 hours leading into Friday, DefiLlama data shows it processed about $6 billion in outflows.

That magnitude highlights a central challenge for exchanges and users during major incidents: even when reserves are substantial, liquidity and withdrawal availability can become the focal point, particularly if customers rush to self-custody. Binance’s approach—reserving funds internally, delaying withdrawals until security checks are complete, and publishing proof-of-reserves—appears designed to address confidence concerns while attempting to maintain operational controls.

It also echoes how previous major crypto crime investigations in the US have involved both on-chain recovery and law-enforcement action. In February 2022, the US Department of Justice said law enforcement agencies, including the FBI, helped seize 94,000 Bitcoin linked to the 2016 Bitfinex hack, which the DOJ valued at $3.6 billion at the time. The DOJ statement underscores that recovery timelines can be long and often depend on the ability to identify assets, follow transfers, and coordinate across multiple entities.

What to watch next

From here, the most immediate markers are Binance’s staged withdrawal reopening from Sunday and the proof-of-reserves update expected Monday, alongside continuing efforts by the FBI and Secret Service to map stolen funds. Investors and users should watch how quickly the exchange can resume withdrawals safely, and whether investigators’ tracing results align with TRM Labs’ attribution and emerging on-chain movement of the compromised assets.