Binance $6.3B Breach: Circle Freezes $800M USDC as Secret Service and FBI Join Recovery
Binance is working with the US Secret Service, the FBI and Circle after a October 29 breach drained roughly $6.3 billion in assets. Circle has frozen more than $800 million in USDC and Tether about $1.57 billion in USDT, while Binance has reserved over $6.34 billion to repay affected users.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Recovery Effort Under Way
Circle has frozen more than $800 million in USDC linked to the October 29 breach at Binance, according to both Crypto Briefing and Decrypt, and is coordinating with law enforcement. Tether has separately frozen about $1.57 billion in USDT, Crypto Briefing reported, bringing combined frozen stablecoin balances to roughly $2.4 billion. Crypto Briefing puts the total frozen across all assets near $3 billion.
The US Secret Service and the FBI are both involved, alongside Binance. Crypto Briefing reported the Secret Service partnership was confirmed on October 30, 2026. Decrypt, citing Reuters, reported that the FBI confirmed awareness of the incident and was working with public and private partners to assess its scope, while the Secret Service did not comment publicly.
Disagreement on the Size of the Theft
The sources differ on the headline loss. Crypto Briefing cites approximately $6.3 billion in stolen assets, while Decrypt reports $6.4 billion. Binance CEO Richard Teng, as quoted by Decrypt, said the exchange had reserved more than $6.34 billion to cover stolen assets. Crypto Briefing describes that reserve as slightly exceeding the reported theft, which suggests full coverage is possible on paper. Neither source offers a reconciled figure, so the $6.3 billion to $6.4 billion range is the most defensible description.
The sources also differ on how quickly the theft occurred. Crypto Briefing reports the attack unfolded within 20 minutes and spread across ten blockchains.
Stablecoin Freezes and Why Other Assets Are Harder
Both sources explain that Circle and Tether can blacklist addresses holding their tokens, which lets them immobilize funds before investigators identify the people responsible. Crypto Briefing notes that Bitcoin and Ether have no central issuer and therefore no equivalent mechanism, so recovering those assets would likely require cooperation from other exchanges where funds surface and court action across several jurisdictions. Decrypt adds that Circle CEO Jeremy Allaire said the company would continue supporting the investigation.
Attribution and Earlier Incidents
Blockchain intelligence firms TRM Labs and Chainalysis have linked the theft to TraderTraitor, a group associated with North Korean cyber operations, according to Decrypt. Crypto Briefing reports that analysts have suggested the same group, but says the attribution has not been confirmed by the agencies leading the case. Decrypt also notes the FBI previously attributed the $1.5 billion Bybit hack in February 2025 to North Korean hackers.
Decrypt reports that Binance's chief security officer has said North Korean operatives repeatedly contacted employees through LinkedIn. Decrypt also notes an earlier joint effort, Operation Atlantic, in which the Secret Service and partners identified more than 20,000 victims of approval phishing scams in April.
Binance's Repayment Plan and Open Questions
Binance says it will cover losses using company funds and its Secure Asset Fund for Users, and plans to repay users in the same tokens they lost, according to Crypto Briefing. Decrypt reports that approximately $3 billion had been located or frozen with industry partners as of Teng's remarks. The exchange's initial suspicion centered on a compromised laptop belonging to a DevOps engineer; it has since identified additional breach points and says it found no evidence that wallet private keys leaked, per Decrypt. Withdrawals remain suspended while Binance reviews its infrastructure, with a resumption targeted for Sunday according to Decrypt.
The key figure to watch is the eventual recovery rate, since roughly half the stolen value had been frozen by the time of reporting and much of the remainder sits in assets without a central issuer.
Why It Matters
For Traders
Binance withdrawals remain suspended and the recovery rate on non-stablecoin assets is uncertain, so exposure to exchange-linked liquidity and related pairs carries near-term volatility risk.
For Investors
The breach highlights concentration risk at a single exchange and shows stablecoin issuers can freeze funds, a control that could shape how institutions weigh USDC and USDT exposure.
For Builders
Protocols that rely on exchange custody or stablecoin transfers should review blacklisting risk and key-management practices, since the breach traced partly to a compromised employee device.
This article is for information only and is not financial advice. Read the full disclaimer.
