The US Secret Service is working with stablecoin issuer Circle to recover funds stolen in the $6.3 billion security breach at Binance. The effort also involves the FBI and cryptocurrency industry firms.
London's trading industry is coming home!
Crypto Briefing reported that the Secret Service confirmed its cooperation with Circle on October 30, a day after the breach. Reuters separately reported, citing a person familiar with the matter, that Binance is working with both the FBI and the Secret Service.
FBI Coordinates Binance Hack Investigation
The FBI said it was aware of the incident and was working with public- and private-sector partners to assess its impact and coordinate investigative steps.
- India Names Binance and Bybit Among Foreign Platforms in $585M Crypto Remittance Probe
- Crypto.com Enters US Crypto Perpetuals Market for Retail Traders as Kraken and Kalshi Expand
- Why Is Crypto Going Down? Bitcoin Tests $80,000 as Ethereum, XRP and Dogecoin Sink to August Lows
Circle has frozen more than $800 million in USDC linked to the breach, according to its CEO, Jeremy Allaire, who said the action was taken in coordination with law enforcement. Tether has also frozen nearly $1.57 billion in related USDT, according to CEO Paolo Ardoino.
JUST IN: 🇺🇸 US Secret Service is working with Circle to identify, freeze, and recover funds stolen from Binance. https://t.co/v8kGqYRh5r
— Watcher.Guru (@WatcherGuru) October 30, 2026
The freezes by the two stablecoin issuers total more than $2.37 billion. Binance has put the total value of assets frozen by industry partners at around $3 billion, including actions by other firms.
Circle and Tether can freeze their stablecoins at specific blockchain addresses, allowing them to restrict transfers linked to the incident. However, frozen assets have not necessarily been recovered or returned to affected users.
TRM, A U.S.-based blockchain intelligence firm, attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. “We make this judgment with high confidence,” the firm said in a post on its website Thursday. https://t.co/jQtTVPVJGQ
— NBC 6 South Florida (@nbc6) October 30, 2026
TRM Attributes Binance Attack to “North Korea”
Separately, blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, with “high confidence”. TRM said its assessment was based on on-chain and off-chain intelligence. The firm is tracking the funds and alerting industry partners through its Beacon Network.
