Following the $6.3 billion theft , US regulators have launched an investigation into how the Binance hack may have affected American banks, as concerns grew over security gaps extending beyond the crypto exchange itself. On Monday morning, officials from the Federal Reserve and the Office of the Comptroller of the Currency reached out to banks to inquire about any irregular activity or disruptions to services.
Key takeaways
The Fed and OCC are checking banks’ exposure to similar attacks.
Binance described a five-month operation involving recruitment deception, malware and an internal AI tool.
Binance said it intercepted or froze about $2.85 billion and replenished 98% of affected tokens.
Regulators examine the Binance hack’s impact on US banks
The Federal Reserve and OCC are treating the largest crypto theft on record as a potential concern for traditional finance. Their outreach focuses on checking bank systems as connections between lenders and the crypto industry have grown.
Banks are studying the attack, running diagnostics and reviewing their cybersecurity defenses against similar techniques. Within hours of the theft, a cybersecurity team at one of the largest US banks contacted its counterparts at Binance .
The team is currently drafting an internal report that will prompt a thorough examination of the bank’s systems, potentially resulting in enhanced security measures. Banks are also committing resources to checking and patching their cybersecurity code.
Binance said it maintains close contact with regulators worldwide and keeps them informed about the breach.
A five-month attack turned internal tools against engineers
Binance said the theft followed a five-month campaign that began with a fake job interview, well before the attackers moved any coins. The operation combined a staged recruitment process, a poisoned software download and malware designed to evade endpoint detection.
Attackers also turned an internal AI tool against Binance’s wallet engineers. The methods described by the exchange, including social engineering, malicious downloads and compromised internal tools, are threats that extend beyond crypto businesses to other large financial institutions.
The bank reviews are examining defenses against the techniques used in the attack.
Funds began moving out of Binance’s hot wallets across multiple blockchains on October 29. Blockchain analysis firms Chainalysis and TRM Labs linked the attack to TraderTraitor, a unit associated with North Korea.
Asset recovery and a broader role for banks in crypto
Binance said it froze or intercepted approximately $2.85 billion in stolen assets and used its own funds to replenish 98% of affected tokens . The exchange resumed withdrawals in stages four days after funds began leaving its wallets, starting with bitcoin.
The regulatory checks follow changes that made it easier for US banks to undertake crypto activities. In March 2025, the OCC removed the requirement for national banks to obtain supervisory nonobjection before engaging in crypto custody and stablecoin activities.
The Fed followed in April 2025 by withdrawing guidance requiring state member banks to notify it before beginning crypto activities. Banks’ expanding work in bitcoin custody, stablecoin issuance and services for exchanges provides the context for supervisors’ attention to a breach at a major crypto platform.
A separate incident also affected a traditional lender. French bank Credit Mutuel Arkea confirmed on Wednesday that a cyberattack enabled fraudulent transfers from its own account. An onchain investigator valued the alleged theft at more than $133 million; the bank did not confirm that figure. Credit Mutuel Arkea said customer assets were unaffected.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
