Supervisors from the Federal Reserve and the Office of the Comptroller of the Currency began contacting US banks on Monday morning to check whether their systems had vulnerabilities after the $6.3 billion Binance hack, according to people familiar with the matter. Bank regulators are treating the largest crypto theft on record as a possible risk to traditional finance, not just a problem for exchanges.
What supervisors asked
The questions focused on unusual activity or disruption in bank services. A source at one bank that regulators contacted said there had been no disruptions: employees prepared talking points for customers but have received few inquiries.
- Banks are studying the attack and running diagnostics on their own systems to confirm they can defend against something similar
- Within hours of the hack, a cybersecurity team at one of the largest US banks reached out to counterparts at Binance
- That team is writing an internal report that will lead to a review of the bank's systems and possibly cybersecurity updates
- It is not yet clear whether the bank would be vulnerable to the same tactics
The biggest concern, one person said, is that AI models are evolving quickly, making it hard for banks to keep up with attackers. Banks are devoting significant resources to reviewing and patching their cybersecurity code.
What Binance says
Binance said it was not aware of conversations between banks and regulators, or whether the hack had any impact on US banks. "We are in close contact with regulators all over the world, keeping them up to date on this security breach," a company spokesperson said.
According to Binance, the theft began with a fake job interview and ran for five months before any coins moved. The campaign combined a poisoned software download, a staged recruitment process, malware that evaded endpoint detection and an internal AI tool the attackers turned against the company's own wallet engineers.
Date | Event |
|---|---|
Oct 29 | Funds begin leaving Binance hot wallets across multiple blockchains |
Nov 2 | Binance reopens withdrawals in stages, starting with Bitcoin |
Nov 2 | Fed and OCC supervisors begin contacting banks |
Nov 4 | Crédit Mutuel Arkéa confirms a cyberattack on its own account |
Chainalysis and TRM Labs linked the attack to TraderTraitor, a unit associated with North Korea. Binance said it froze or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds.
Why banks are now in the picture
The checks follow a year and a half in which US regulators cleared the way for banks to do more in crypto. In March 2025 the OCC rescinded its requirement that national banks get supervisory nonobjection before taking on crypto custody and stablecoin activities, and the following month the Fed withdrew guidance that required state member banks to notify it before starting crypto activities.
As more banks custody Bitcoin, issue stablecoins and serve exchanges, a breach at a major crypto platform becomes a question for bank supervisors too. Neither the Fed nor the OCC has publicly announced new guidance tied to the Binance hack.
Traditional lenders are not immune from large thefts either: Crédit Mutuel Arkéa confirmed on Wednesday a cyberattack that allowed fraudulent transfers from its own account, which an onchain investigator put at more than $133 million. The bank has not confirmed that figure and said customer assets were not affected.