Binance founder Changpeng Zhao has thanked the U.S. Secret Service and federal investigators for helping freeze stolen cryptocurrency following the more than $6 billion hack of the exchange last week.
Summary
- Binance founder Changpeng Zhao thanked the US Secret Service and other federal agencies for responding within minutes of the $6 billion hack and helping freeze a significant portion of the stolen cryptocurrency.
- The Secret Service confirmed that investigators worked with industry partners shortly after the October 29 attack to identify and freeze stolen assets, although the agency did not disclose the exact amount secured.
- The FBI attributed the theft to North Korean hackers known as TraderTraitor and said the attackers were converting stolen cryptocurrency primarily into Ethereum, with further laundering through DeFi and instant swap services expected.
- Zhao said the quick response from investigators and cryptocurrency industry partners helped contain the damage and reduce the risk of further disruption across crypto and traditional financial markets.
In a November 2 post on X, Zhao, commonly known as CZ, praised the agencies and industry partners for responding within minutes of the October 29 attack, saying their efforts helped contain the damage and reduce the risk of further disruption across cryptocurrency and traditional financial markets.
“Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets,” Zhao wrote.
His comments followed a November 1 announcement from the Secret Service confirming that investigators were continuing efforts to trace and recover cryptocurrency stolen from Binance Global.
Secret Service confirms significant funds frozen after Binance hack
According to the Secret Service, investigators worked with cryptocurrency industry partners shortly after the theft occurred on Thursday afternoon and managed to identify and freeze a significant portion of the stolen assets.
The agency did not disclose the exact amount frozen during its initial response but confirmed that efforts to recover the remaining funds were continuing.
Federal investigators are working alongside the FBI, IRS Criminal Investigation, the U.S. Attorney’s Offices for the District of Columbia and Central District of California, and several divisions of the Department of Justice.
The investigation includes the DOJ’s Computer Crime and Intellectual Property Section and National Security Division, which are assisting authorities in tracking the stolen cryptocurrency.
As crypto.news previously reported, Binance estimated that approximately $6.3 billion in cryptocurrency was affected by the October 29 breach, while industry partners had frozen roughly $3 billion in stolen assets.
Blockchain intelligence firm TRM Labs separately estimated that the attackers transferred approximately $6.36 billion across 10 blockchain networks, with most of the funds moving within roughly 20 minutes.
Investigators have since continued tracing the stolen assets through multiple cryptocurrency wallets, while exchanges and other service providers have been asked to help prevent further transfers.
Zhao thanked the agencies for their continued involvement, saying their quick response had helped contain the damage from the attack.
FBI attributes $6 billion Binance theft to North Korean hackers
The FBI has officially attributed the attack to North Korean hackers operating under the name TraderTraitor.
In its October 31 announcement, the agency said the Democratic People’s Republic of Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29.
Investigators working with the Secret Service and IRS Criminal Investigation have observed the attackers converting stolen assets primarily into Ethereum.
The FBI expects the hackers to continue laundering the cryptocurrency through decentralized finance protocols and instant swap services, which allow assets to be exchanged without relying on traditional centralized trading platforms.
Federal authorities have urged THORNode operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block transactions involving wallets connected to the theft.
The agency published a list of Ethereum addresses that currently hold or previously held stolen cryptocurrency and identified them as being operated by or closely connected to TraderTraitor actors.
The attribution follows findings from Chainalysis, which linked North Korean hackers to approximately 89% of cryptocurrency theft losses recorded during 2026.
The October 29 attack has become one of the largest cryptocurrency security incidents on record, exceeding the roughly $1.5 billion stolen from Bybit in February 2025.
Binance continues recovery and customer protection efforts
Binance has maintained that affected users will be covered for losses arising from the incident, with the exchange planning to use company resources and its Secure Asset Fund for Users.
The exchange’s preliminary investigation suggested that attackers may have compromised a DevOps engineer’s laptop, potentially allowing unauthorized access to an internal service container used to submit withdrawal transactions.
Binance said it had found no evidence that wallet private keys were leaked and subsequently revoked the affected authorization while working with investigators.
The incident had immediate consequences for cryptocurrency markets, with Bitcoin and major altcoins falling as liquidations exceeded $1.5 billion on October 30.
Binance temporarily restricted withdrawals following the breach while carrying out security checks and preparing to restore services across affected networks.
The exchange has pledged to cover customer losses using both its insurance fund and company resources, although the final amount required will depend partly on how much stolen cryptocurrency can be recovered.
Meanwhile, the FBI has requested information from anyone who may have details about the attackers or transactions associated with the theft.
Individuals and cryptocurrency businesses can contact their local FBI field office or submit information through the agency’s Internet Crime Complaint Center.
Federal authorities have continued coordinating with cryptocurrency service providers to identify wallets connected to the theft and restrict further movement of stolen assets.
