• U.S. Secret Service and private partners, including Circle (CRCL), have frozen or located roughly $3 billion of the $6.3 billion stolen from Binance.
  • Binance has set aside $6.34 billion of company funds to cover losses, but withdrawals remain suspended and the source of that funding is unclear.
  • Blockchain analysts attribute the attack to North Korea with high confidence; Bitcoin fell to a six-week low as the breach intensified an already weak crypto market.

A $6.3 Billion Heist and a Frantic Freeze

Investigators are racing to recover funds after a massive breach at Binance, the world’s largest cryptocurrency exchange. The U.S. Secret Service said Thursday it is working with private-sector partners, including stablecoin issuer Circle, to identify, freeze, trace, and recover funds stolen in the October 29 attack. The theft, estimated at approximately $6.3 billion, is potentially the largest cryptocurrency theft on record.

Binance reports that roughly $3 billion has been frozen or located through partners. Circle said it froze more than $800 million in USDC, while Tether reported nearly $1.57 billion. Those figures are evolving and may overlap, and they do not necessarily add up to Binance’s total.

“Frozen does not mean recovered or returned to customers,” said Ari Redbord, policy head at blockchain-analysis firm TRM Labs, in an interview with CNBC (VSNT). He noted that returning funds generally requires a separate legal process, such as a court order or seizure warrant. Chainalysis researcher Eric Jardine cautioned that technical freezes can happen quickly, but returning funds can take months or years.

Binance says it will cover all losses with company resources, setting aside approximately $6.34 billion of company funds. However, Reuters (TRI) noted that the exchange did not explain the source of that funding. The commitment is a corporate statement, not independent verification that every liability has been reconciled.

Withdrawals Suspended as Investigation Widens

Binance suspended withdrawals following the breach. Early Friday, the exchange said it expected to restore them within 48 hours, but the sources reviewed do not establish that withdrawals have already resumed. The disruption has left customers unable to access funds, amplifying uncertainty.

Binance is cooperating with the FBI and U.S. Secret Service, according to Reuters. Blockchain-analysis firms TRM Labs, Chainalysis, and Elliptic have attributed the attack to North Korea with high confidence, though Binance itself has not publicly attributed responsibility to any individual. The attribution remains an analytical assessment, not a publicly announced U.S. government finding.

Binance’s preliminary investigation points to a compromised engineer’s laptop that enabled unauthorized withdrawals. The exchange subsequently reported additional breach points, and the final root cause remains unresolved.

Market Rattled as Crypto Prices Slide

The breach has intensified an already weak cryptocurrency market. Bitcoin fell to a six-week low of $76,368, while ether dropped more than 3% to a two-month low, and Binance’s BNB token declined approximately 5.3% over 24 hours. Analysts cited higher U.S. interest rates and softer demand from exchange-traded-fund buyers as existing pressures. The breach adds counterparty and custody concerns to those macroeconomic headwinds.

“It could further weaken risk appetite and cause investors to reassess assets held on centralized exchanges,” said Tim Sun, a researcher at HashKey (3887.HK).

The incident also comes as the U.S. implementation of the GENIUS Act stablecoin framework moves forward. The OCC finalized its implementing rule on October 21, with effectiveness scheduled for January 18, 2027, according to an October 29 analysis by law firm Skadden. The framework increases the importance of regulated issuance, reserves, redemption, and risk management.

Circle’s Role: Freezing USDC, Not Breached

Circle, a publicly listed financial-technology company (NYSE: CRCL), issues USDC and EURC through regulated affiliates. Its USDC circulation reached $73.3 billion at June 30, 2026. The company reported Q2 2026 revenue and reserve income of $701 million, up 7% year over year, with net income from continuing operations of $48 million and adjusted EBITDA of $143 million, up 8%. The profit improvement largely reflected lower stock-based compensation following its 2025 IPO.

Circle is helping immobilize stolen USDC, but the reporting does not describe a breach of Circle’s own reserve assets or systems. “The capability to freeze tokens gives centralized companies significant control, which is a trade-off in cryptocurrency design,” said a person familiar with the matter.

Binance and Circle have deepened their relationship in recent months. On September 22, the two announced a $100 million Binance equity investment in Circle and a five-year commercial agreement to expand USDC distribution, particularly in emerging markets. Circle agreed to pay Binance monthly incentives under the arrangement.

Regulatory Scrutiny and Broader Implications

Abu Dhabi’s Financial Services Regulatory Authority, which issued Binance’s main operating licence, said it is engaging with the exchange and monitoring the incident. U.S. investigative involvement therefore sits alongside oversight in Binance’s principal licensing jurisdiction.

If the North Korean attribution is confirmed, the theft becomes a state-linked financial-security issue, not simply an exchange cybersecurity failure. Reuters notes that U.S. and South Korean authorities have long identified North Korean cyber units as sources of financial theft and state revenue; North Korea routinely denies those allegations.

The breach is part of a wider pattern. Reuters reports that roughly $2.9 billion was stolen across nearly 150 crypto attacks in 2025, while Bitget reported an approximately $350 million theft in September 2026. The Binance incident alone substantially exceeds those reported annual losses. TRM estimates that approximately $6.36 billion moved across ten blockchains, mostly within about 20 minutes, and compares the incident with the $1.5 billion Bybit theft of February 2025, which the FBI attributed to North Korea.

Moody’s (MCO) analyst Cristiano Ventricelli said broader implications depend on ultimate losses, affected counterparties, recovery, and whether confidence deteriorates across the ecosystem. A wider banking or national-economic crisis is not established by the available evidence.

What’s Next

The main milestones are restoration of withdrawals, independent verification of Binance’s coverage resources, reconciliation of frozen totals, and publication of a credible root-cause analysis. Recovery may be slow even where assets are already immobilized. TRM’s preliminary assessment points to compromised signing capability across multiple chains and recommends separation of signing systems and tighter authorization policies. That remains an expert assessment pending Binance’s final findings.

The decisive uncertainty is the ultimate unrecovered loss and whether Binance can absorb it without prolonged disruption or wider counterparty stress. Binance did not respond to a request for comment on the source of its loss-coverage funds. Circle declined to comment beyond its public statements.

Correction: An earlier version of this article misstated the amount Circle froze. It is more than $800 million, not $800 million. The article has been updated to clarify that frozen amounts may overlap and are not additive.