Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million

Binance is working with the FBI and the U.S. Secret Service following a multibillion-dollar exchange hack, according to Reuters as reported by Decrypt. Stablecoin issuers moved quickly in the hours after the theft was identified: Circle froze approximately $823 million in USDC connected to the attack, while Tether CEO Paolo Ardoino said it froze more than 1.567 billion USDT in the statement embedded in Decrypt’s report. The report gives conflicting Tether totals; these should not be treated as a final recovery figure. These are reported freezes, not confirmation that the funds have been returned to customers.

What Happened

A person familiar with the matter told Reuters that Binance was cooperating with law enforcement agencies around the world, including both the FBI and the Secret Service. The FBI confirmed it was aware of the incident and said it was working with public and private partners to assess its scope and coordinate investigative steps. The Secret Service, which investigates computer crimes, unauthorized access to systems, and digital-currency crimes in addition to its protective duties, did not comment publicly, according to Decrypt's report.

Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC associated with the Binance incident and would continue supporting the investigation — a figure Decrypt's sourcing places at approximately $823 million. Tether, the issuer of the competing USDT stablecoin, froze a separate pool of tokens; Decrypt's report cites Tether CEO Paolo Ardoino's own statement that the company froze "more than 1.567B USDT related to a potential Binance exchange hack," while the report’s summary gives a different, smaller figure. Those estimates should not be combined. Both companies retain the technical ability to blacklist specific blockchain addresses, which prevents tokens they issue from moving out of those wallets — a capability that gives stablecoin issuers a role in crypto investigations, letting them immobilize stolen funds before investigators identify the individuals responsible.

Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean hacking group previously linked to the $1.5 billion Bybit hack in February 2025, an incident the FBI also attributed to North Korean actors. According to Decrypt, North Korean operatives have previously targeted Binance directly, including by posing as job applicants; Binance Chief Security Officer Jimmy Su told Decrypt in a 2025 interview that North Korean operatives were contacting employees on LinkedIn daily, at times using fake interviews to deliver malware.

Binance CEO Richard Teng said on Friday, per Decrypt, that the company had reserved more than $6.34 billion to cover the stolen assets, and that approximately $3 billion had already been located or frozen with the help of industry partners. The exchange initially suspected that a compromised laptop belonging to a DevOps engineer had provided attackers with access to its systems, but has since identified additional breach points. Binance said it found no evidence that wallet private keys had been leaked. Withdrawals remain suspended while the exchange reviews its security infrastructure, with Binance targeting a resumption by Sunday, according to the report.

CoinHours Analysis: Market Reaction

CoinHours' own cached market data (saved 2026-10-30T17:05:08.874+00:00) shows the broader crypto market trading sharply lower in the period surrounding this news. Binance ticker data saved by CoinHours at 2026-10-30T17:05:08 UTC recorded Bitcoin at $77,431.03, down 4.654% over 24 hours and down 5.33939783% over seven days, with 24-hour trading volume of $2,640,002,165.65. CoinMarketCap-sourced data cached by CoinHours at 2026-10-30T17:05:22 UTC put Bitcoin at $77,291.13, down 4.76054691% in 24 hours, down 5.33939783% over seven days, and down 8.27751384% over 30 days, with a market cap of $1,553,966,342,296.06.

A CoinHours-saved short-term Bitcoin chart (chart_short:bitcoin, Binance-sourced, cached at 2026-10-30T17:05:13 UTC) shows the first observation in the window at $81,649.25 and the last at $77,420.18 across 169 data points, showing a decline within that saved window, not proving a response to this event. CoinHours' saved Fear & Greed Index reading (saved 2026-10-30T17:05:08.874+00:00), sourced from Alternative.me and cached at 2026-10-30T17:05:23 UTC, stood at 30, classified as "Fear." CoinHours' saved global market snapshot, sourced from CoinMarketCap at 2026-10-30T17:05:07 UTC, recorded total crypto market capitalization of $2,597,346,458,498.93, total 24-hour volume of $149,879,134,200.30, Bitcoin dominance of 59.831070498587%, and a 24-hour global market cap change of -4.39645419%.

On the stablecoin side, CoinHours' cached top_coins_usd data (CoinMarketCap, 2026-10-30T17:05:22 UTC) showed USDC trading at $0.9998749941776122, up a marginal 0.01276493% over 24 hours, while Tether USDt traded at $0.99895837078057, up 0.00847814% over the same window — both pegs holding despite the scale of the freezes each issuer executed. CoinHours' Binance ticker snapshot (saved 2026-10-30T17:05:08.874+00:00) separately listed USDC at $1.00149, up 0.059% in 24 hours. This CoinHours analysis is offered as supporting market context only; the cached figures do not establish that the Binance hack caused the broader market decline, and readers should treat the Fear & Greed reading and Bitcoin's drawdown as concurrent conditions rather than confirmed consequences of this specific event.

Why It Matters

The reported investigation involves different kinds of response: agency inquiries, issuer-level freezes and Binance’s stated plan to cover losses. Decrypt’s account does not establish that identifying or freezing funds is the same as recovering them for customers. Its report says approximately $3 billion had been located or frozen with industry partners, while Binance had reserved more than $6.34 billion to cover stolen assets. Those descriptions should remain distinct. The reported withdrawal target is also a company expectation, not confirmation that withdrawals have resumed. These qualifications matter when assessing the response without overstating how much of the incident has been resolved.