Fed and OCC Reportedly Check Bank Defenses After Binance Hack

U.S. banking regulators contacted lenders after Binance’s $6.3 billion hack to check for vulnerabilities and service disruptions. The inquiries brought the incident into bank supervision, although the report did not establish that the attack had compromised U.S. lenders.

Federal Reserve and Office of the Comptroller of the Currency supervisors began contacting banks on Nov. 2, according to people familiar with the matter. Both regulators declined to comment.

Supervisors Ask About Disruptions and Unusual Activity

One person at a contacted bank cleared that its services had experienced no disruption. Staff prepared talking points for customers but received few inquiries.

Banks were also running diagnostics and examining whether their defenses could withstand similar tactics. The reported contacts concerned security checks, rather than an announced requirement to suspend crypto services or restrict customer accounts.

A cybersecurity team at a major U.S. bank contacted Binance within hours of the theft. The team was preparing an internal report that would lead to a review of the bank’s systems and potentially cybersecurity updates.

Binance revealed that it was unaware of the reported bank-regulator conversations or whether the attack had affected U.S. banks. It was keeping regulators worldwide informed about the breach.

Binance Describes Compromised Internal Access

Binance’s Nov. 3 findings described a campaign involving fake recruitment interviews, malicious software and compromised internal AI tooling. Attackers ultimately reached a wallet-signing service, allowing them to initiate transfers outside the normal withdrawal process.

The exchange stated that the malicious on-chain permissions also allowed some transfers to continue after withdrawals were suspended. Revoking those permissions required additional work, so shutting down the withdrawal service did not immediately stop the unauthorized movements.

Binance had closed identified entry points, rebuilt or replaced affected systems and introduced tighter device and wallet controls. Its investigation remained ongoing, with independent security reviews planned.

FBI Calls for Blocking Linked Transactions

The FBI attributed the Oct. 29 theft to North Korean activity it calls TraderTraitor. Its Oct. 31 alert stated that the investigators had observed stolen assets being converted primarily into ether.

The bureau issued the alert alongside findings from the U.S. Secret Service and IRS Criminal Investigation. The agencies urged crypto infrastructure providers to block transactions with, or derived from, the identified laundering addresses.