US Secret Service Joins Circle, Tether in Freezing $2.37B in Binance Hack Funds

The US Secret Service is working with stablecoin issuer Circle to recover funds stolen in the $6.3 billion security breach at Binance. The effort also involves the FBI and cryptocurrency industry firms.

London's trading industry is coming home!

Crypto Briefing reported that the Secret Service confirmed its cooperation with Circle on October 30, a day after the breach. Reuters separately reported, citing a person familiar with the matter, that Binance is working with both the FBI and the Secret Service.

FBI Coordinates Binance Hack Investigation

The FBI said it was aware of the incident and was working with public- and private-sector partners to assess its impact and coordinate investigative steps.

Circle has frozen more than $800 million in USDC linked to the breach, according to its CEO, Jeremy Allaire, who said the action was taken in coordination with law enforcement. Tether has also frozen nearly $1.57 billion in related USDT, according to CEO Paolo Ardoino.

JUST IN: 🇺🇸 US Secret Service is working with Circle to identify, freeze, and recover funds stolen from Binance. https://t.co/v8kGqYRh5r

The freezes by the two stablecoin issuers total more than $2.37 billion. Binance has put the total value of assets frozen by industry partners at around $3 billion, including actions by other firms.

Circle and Tether can freeze their stablecoins at specific blockchain addresses, allowing them to restrict transfers linked to the incident. However, frozen assets have not necessarily been recovered or returned to affected users.

TRM, A U.S.-based blockchain intelligence firm, attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. “We make this judgment with high confidence,” the firm said in a post on its website Thursday. https://t.co/jQtTVPVJGQ

TRM Attributes Binance Attack to “North Korea”

Separately, blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, with “high confidence”. TRM said its assessment was based on on-chain and off-chain intelligence. The firm is tracking the funds and alerting industry partners through its Beacon Network.

CFTC Cites Binance Hack in Registration Push

Separately, CFTC Chairman Michael Selig cited the Binance breach as support for a proposed voluntary registration framework for offshore cryptocurrency exchanges serving US retail traders. Under the plan, participating platforms would be required to meet US cybersecurity and customer protection standards. Selig said broader federal registration would require congressional action. The CFTC is targeting December 14, 2026, for the proposed rulemaking.