Binance $6.3B Hack Prompts Fed and OCC Bank Checks

Fed and OCC checks follow Binance theft

Reuters reports bank diagnostics and a major bank team’s contact with Binance. Its potential vulnerability remained unclear.

Binance told Reuters it was unaware of those supervisory conversations or US bank impact. Checks alone do not demonstrate a spreading compromise.

This is a different development from Binance’s expanded Ethereum and Solana withdrawals. That phase concerned customers moving assets from the exchange. The new report concerns how bank supervisors and security teams are assessing lessons from the theft.

The policy backdrop already permits some bank crypto services. In May 2025 guidance, the OCC confirmed that national banks could execute customer-directed trades in assets held in custody and outsource permissible crypto activities, subject to appropriate third-party risk management.

Its announcement retained the requirement to operate safely and comply with applicable law. Permission to provide custody did not eliminate operational responsibilities when a bank uses another provider. The practical distinction is between being authorized to offer a service and having controls appropriate to its operation.

Binance hack losses remain above $6 billion

The loss-impact check reviewed November 5 around 15:00 UTC found extensive observed theft evidence. Bitquery’s investigation, with holdings measured at 07:37 UTC November 5, traces about $6.3 billion from 17 Binance hot wallets across nine chains. It reports $2.7 billion frozen or rescued and about $3.2 billion still held by the attacker.

Those 17 wallets belong to exchange infrastructure. They are not a count of individual customer victims, and the reviewed sources did not establish a verified unique customer-victim total.

Elliptic’s final incident update, dated November 1 at 08:00 UTC, estimates $6.43 billion stolen across eleven chains and $2.85 billion frozen or seized. It identifies $3.80 billion taken on Ethereum and 18,270 stolen bitcoin.

TRM Labs’ earlier assessment, covering observations through October 30 at 00:30 UTC, put the theft at $6.36 billion across ten chains. It identified a later wave around 23:05 UTC October 29 affecting Avalanche and Polygon. That was part of the original attack, not evidence of a new November breach.

These estimates overlap and cannot be added. Their different coverage, valuation and observation times also mean they should not be treated as successive readings of one standardized recovery counter.

The FBI’s October 31 notice attributes the theft to North Korea’s TraderTraitor activity. It says investigators observed conversion of stolen assets primarily into Ether and supplies addresses for transaction blocking.

Bank custody controls face an operational test

A freeze can prevent an attacker from moving tokens without returning them to the exchange. Likewise, Binance’s company-funded replacement allocation concerns resources used to restore backing. Replacement, freezing and recovery describe different financial outcomes.

The technical evidence also points beyond a simple missing-password explanation. TRM describes an Ethereum authorization that let attacker-controlled code sweep a hot wallet, alongside ordinary signed transfers on other networks. That makes the process for approving transactions relevant alongside the storage of signing material.

For banks, the existing interagency statement calls for scrutiny of sub-custodian controls, contingency planning and audits covering transfers and settlement. It also says customer agreements should clearly allocate responsibilities. Those requirements provide a framework for reviewing operational exposure; the report does not establish that any specific bank failed them.

That framework treats outsourcing as a risk-management decision. Its guidance says banks should assess a provider’s key-management controls before selection and consider what insolvency or an operational disruption would mean for access to customer assets. Keeping records and planning for disruption remain relevant even when the underlying blockchain continues to operate.

The July 2025 statement expressly created no new supervisory expectations. Today’s reported outreach has not been accompanied in the reviewed sources by a new public rule, a named list of affected banks or a confirmed banking loss total.

Broader sentiment was 50, or Neutral, against 34 the previous day on Alternative.me’s Bitcoin-focused index, checked November 5 around 15:00 UTC. That measures market sentiment, not the safety of any institution.

The next substantive disclosures would be confirmed bank findings, published supervisory action or evidence that frozen assets have actually been returned. Until then, the bank checks broaden the response to the Binance incident while leaving their operational results undisclosed.