Fed and OCC Review US Banks After Binance Breach; Experts Cite Security Gaps

US regulators have reportedly reached out to banks after last week’s Binance hack, according to Reuters—an episode regulators and cybersecurity specialists say is forcing closer scrutiny of how traditional financial institutions manage crypto-linked security risks.

Reuters reported that officials from the Federal Reserve and the Office of the Comptroller of the Currency (OCC) started contacting banks on Monday to ask about “unusual activity” or any service disruptions. The move highlights concerns that a fast-moving, high-impact crypto incident could expose weaknesses in custody arrangements, counterparty controls, and incident response processes at banks that touch digital-asset services.

Key takeaways

• Reuters says the Federal Reserve and OCC have begun contacting banks to check for “unusual activity” and potential disruptions after the Binance hack.
• CertiK’s Stefan Muehlbauer said it would be expected for supervisors to assess exposures and how quickly banks can respond following a breach of this scale.
• Binance reported that about $6.34 billion in assets were affected, with $2.85 billion frozen or intercepted as of its incident report.
• Cybersecurity experts argue attacks that compromise people and trusted systems can create new risks for banks offering crypto custody or payment services.
• The inquiries come after the Fed removed an April 2025 requirement for state member banks to notify regulators before engaging in crypto activities.

Regulators probe banks after a $6.3 billion incident

Under the reported outreach, the Federal Reserve and the OCC are asking banks about any unusual activity or disruptions that may have occurred in connection with the Binance breach, Reuters said, citing people familiar with the matter.

Stefan Muehlbauer, head of US government affairs at CertiK, said the scrutiny could extend to how banks manage crypto-related risk areas such as custody, counterparty exposure, and their ability to respond to incidents. In comments to Cointelegraph, he framed the contact as part of a normal supervisory function rather than a sign that regulators are stepping back from the crypto sector.

“After an incident of this scale, it would be surprising if the Fed and OCC didn’t check in with the banks they supervise,” Muehlbauer said. He added that regulators’ mandate is to protect the financial system by understanding where exposures sit and how quickly institutions can act.

Cointelegraph also reported that a Federal Reserve spokesperson said the agency had nothing to share regarding the alleged inquiries. The OCC did not respond to Cointelegraph’s request for comment at the time of publication.

Why this matters for banks: exposures, custody, and incident readiness

Reuters reported that some banks have been assessing the hack and reviewing their own systems to evaluate whether they could absorb or manage similar threats. The question for traditional institutions is not only whether they can withstand a cyber event, but whether their operational controls remain effective when attackers target the “trusted” layers that enable money movement.

Reuters also noted that a cybersecurity team at one of the largest US banks contacted Binance within hours of the hack. A Binance spokesperson, speaking to Cointelegraph, said the exchange shared its publicly released incident report with banking partners and was not aware of any vulnerabilities affecting them.

Cybersecurity experts say this type of incident model can be especially challenging for banks that support crypto custody or crypto-related payment workflows. If attackers can reach the systems and processes that authorize transactions—rather than breaking cryptography outright—then monitoring and alerting mechanisms may not trigger until money has already been redirected.

Binance’s incident details and the threat model behind it

In its Nov. 3 incident report, Binance said it was dealing with an attack that affected approximately $6.34 billion in digital assets. As of the report, Binance said $2.85 billion was frozen or intercepted.

According to Binance, the attack began with compromised software installed by an engineer in June. The exchange later described a chain of escalation involving social engineering, stolen credentials, and malicious software used to gain access to wallet systems and conduct unauthorized transfers.

Dr. Darren Williams, founder and CEO of cybersecurity firm BlackFog, told Cointelegraph that these tactics present risks that may translate to traditional banks, particularly those offering services related to crypto custody and payments. He emphasized that attackers may not need to crack encryption or steal private keys if they can compromise trusted systems and the people authorized to move funds.

Williams warned that malicious actors could use compromised employee devices, accounts, or third-party services to move money without triggering conventional defenses. He also flagged the increasing use of agentic AI in financial operations as a potential amplifying factor for fraud and unauthorized actions.

“The priority must be stopping unauthorized transactions and data exfiltration before assets or sensitive information leave the organization, not simply investigating the damage afterwards,” Williams said.

Binance has said it strengthened its security controls and brought in independent cybersecurity experts to review the attack.

Fed oversight shifts: notification rule removed, supervision continues

The reported regulator outreach follows a policy change earlier in the year: in April 2025, the Federal Reserve removed a requirement for state member banks to notify regulators before engaging in crypto activities. The Fed said it would continue overseeing those activities through its regular supervisory process.

That context matters because it frames how regulators may respond when risk materializes. Even without pre-notification rules, supervisors can still adjust attention based on incidents, counterparties, and the real-world performance of controls under stress.

For banks, the immediate takeaway is that crypto incidents can quickly become supervisory issues—not just technical events. For the broader market, it underscores that as digital-asset services integrate further into traditional finance, the security expectations for banks are likely to intensify around incident response speed, access controls, and vendor/partner risk management.

What readers should watch next is whether the reported bank inquiries lead to concrete supervisory findings—such as formal guidance, expanded examinations, or changes in how banks must demonstrate crypto-related security readiness. The full scope of any exposures remains unclear, but the regulatory signal is already visible: major crypto breaches can trigger fast, institution-level checks.