Less than twenty-four hours after a massive theft from Binance came to light, the case had already pulled in the highest levels of the US government. Donald Trump was asked about the breach during a press conference on Friday afternoon. The president said he was looking into the matter and noted that Binance was promising to reimburse its clients, according to The Block. "But it's a hack, that's the problem," Trump said, adding a remark about "when you signed a check" and saying he had "always found that a bit dangerous."
Trump pardoned Binance founder Changpeng Zhao one year ago, a detail that has coloured the political backdrop to the exchange's latest crisis.
Michael Selig, chairman of the Commodity Futures Trading Commission, the US derivatives regulator, also addressed the hack, speaking on CNBC. Selig argued the episode "proves exactly" the case for rules the CFTC proposed at the start of October, which would let foreign exchanges register with the agency and adopt US market cybersecurity standards. "The real problem is unregulated offshore platforms, which don't have the same safeguards as our financial markets in the United States," Selig said. He added that the breach originated from an employee's laptop, not from Ethereum itself.
Senator Cynthia Lummis is attempting to revive the Clarity Act, currently blocked in the Senate, framing the episode as evidence of the need for clearer market-structure legislation. She said law enforcement response capability matters "the moment law enforcement calls." The bill will in any case wait at least until Tuesday's midterms before any further movement.
Law enforcement and blockchain analysts move fast
The FBI confirmed it is working with public and private partners to measure the scope of the attack, while the Secret Service said it is collaborating with private actors, including stablecoin issuer Circle, to identify, freeze and trace the stolen funds. Circle has already frozen about $823 million in USDC.
Chainalysis has attributed the theft to TraderTraitor, the North Korean hacking group already blamed for the Bybit hack in February 2025. Investigators at the blockchain analytics firm said they watched funds leaving Binance mix in real time, around 5:30am Paris time on Friday, with funds stolen from Bitget last month by North Korean hackers. The attacker converted $325 million of stablecoins into $285 million of ether in twenty minutes, before routing $175 million to relay wallets. Thousands of automated transactions, each triggered by sending exactly 1 TRX, were used to fragment the trail on the Tron network.
The first freezes came Thursday at 10:14pm Paris time, less than an hour after the siphoning began. Chainalysis now estimates roughly $2.8 billion has been frozen at this stage.
Binance says it has provisioned $6.34 billion to cover the losses and aims to resume withdrawals on Sunday. Nothing, however, legally obliges the exchange to honour its reimbursement pledge.
