The US Secret Service says it is working around the clock to trace and recover funds stolen in Binance’s $6.3 billion hack, as the FBI joins the hunt for those responsible.
The BBC reported on 30 October 2026 that the Secret Service said it was working around the clock “to identify, freeze, trace, and recover” the stolen funds and would “identify the cyber criminals responsible and bring them to justice.” This article focuses only on that law-enforcement response. The hack itself and the earlier freezing of about $3 billion are covered in Emadan’s prior coverage, linked below.
What investigators say they will do
According to the BBC report, the Secret Service is coordinating with the US Attorney’s Office for the District of Columbia. Binance said it was also working with the FBI, and the FBI said it was “aware of the incident.”
The stated sequence matters for readers trying to follow the money: identify, freeze, trace and recover. Freezing is only one step — and, as the figures below show, it does not by itself guarantee that all stolen assets can be brought back.
How the theft unfolded, as reported
Context, clearly attributed and not presented as new findings in this article: most of the theft took place in about 20 minutes from 20:05 GMT on Thursday 29 October, from wallets Binance uses to process transactions, according to TRM Labs via BBC/Mercopress reporting.
Attackers exploited an Ethereum EIP-7702 mechanism and used a self-destruct mechanism erasing traces, according to the reporting. Binance co-CEO Richard Teng said the attack was “not carried out by one person,” underlining that investigators are likely looking for a coordinated operation rather than a lone actor.
The attribution question
TRM Labs and Chainalysis said they had “high confidence” the culprit is TraderTraitor/Lazarus, a North Korea-linked group. That is an analytics-firm claim, not an official attribution.
There has been no official attribution in the reporting supplied for this article. Readers should therefore treat the North Korea-linked claim as an assessment by blockchain-intelligence firms, while the Secret Service’s public language focuses on identifying the criminals and bringing them to justice, without naming them in the quoted statements.
What is — and is not — recoverable
TRM estimates that about $2.4 billion in bitcoin and ether is beyond reach because no company can block those assets. That distinction is important: stablecoins can sometimes be frozen by their issuers, but bitcoin and ether cannot be blocked in the same way.
Separately, about $3 billion had been frozen on-chain, as already reported in Emadan’s earlier Binance posts. That frozen total is prior coverage, not a new development in this law-enforcement update.
User funds and US jurisdiction
Binance said its US-facing exchange was unaffected, but US authorities have jurisdiction partly because dollar-pegged stablecoins Tether and Circle were involved.
Binance said it set aside more than $6.34 billion in corporate funds to cover stolen assets, was “actively buying” tokens, and told users “your money is safe, and we’re covering every loss.” Withdrawals were initially suspended, with resumption expected within about 40 hours and a full proof-of-reserves report due Monday, per 30 October reporting. This article does not claim that either has happened.
Prior coverage
Emadan’s earlier reporting on the hack is available here: Binance Hack 2026: $6.3 Billion Affected, Withdrawals Paused — What Users Must Do and Binance Says $6.3 Billion Hack May Have Started With a Compromised DevOps Laptop.
What happens next
The next verifiable milestones are law-enforcement and company updates: whether further funds are frozen, whether investigators name suspects or make an official attribution, whether withdrawals resume on the timetable Binance indicated, and whether the promised proof-of-reserves report is published. Until those steps are confirmed, the recovery picture remains partial — part frozen, part traced, and, for about $2.4 billion in bitcoin and ether, estimated by TRM to be beyond reach.
Frequently asked questions
Has anyone officially been blamed for the Binance hack?
No official attribution has been made in the reporting supplied for this article. TRM Labs and Chainalysis have said, with high confidence, that TraderTraitor/Lazarus, a North Korea-linked group, is responsible — but that remains an analytics-firm assessment.
Is all of the $6.3 billion recoverable?
Not on current estimates. About $3 billion had previously been frozen, while TRM estimates about $2.4 billion in bitcoin and ether is beyond reach because no company can block it.
Are Binance users’ funds safe?
Binance has told users their money is safe and that it is covering every loss from corporate funds. Withdrawals were initially suspended, with resumption expected within about 40 hours per 30 October reporting.
Sources
- BBC via ByteS EU — https://www.byteseu.com/2486139/
- Mercopress — https://en.mercopress.com/2026/10/30/hackers-steal-us-6.3-billion-in-crypto-from-binance-in-the-sector-s-biggest-ever-heist
- TOB News — https://tob.news/binance-recovers-half-of-6-3bn-stolen-in-record-cyber-heist/
