FBI and Secret Service open probes into $6.4 billion Binance hack as ETF outflows mount

Attackers stole about $6.4 billion from Binance, the world's largest crypto exchange, in one of the biggest thefts in the industry's history. The FBI and the Secret Service have both opened investigations. Binance says it will cover every stolen dollar from company funds, but investors pulled money out fast, and US Bitcoin ETFs, which are funds that hold Bitcoin and trade on stock markets, saw their worst day of the month on Friday.

The key numbers

• Roughly $6.4 billion was drained from Binance's hot wallets, which are internet-connected wallets used for daily withdrawals. The funds moved across about 10 blockchains, with most of it gone inside 20 minutes on Thursday afternoon.
• That is more than four times the previous record, the $1.5 billion theft from Bybit in February 2025.
• Bitcoin ETFs saw $643.3 million in net outflows on Friday, the biggest day of the month. That turned October from +$127 million to −$515.9 million in total.
• Ethereum ETFs had $156 million leave on Friday and $1.61 billion for October, their worst month since launch.
• Binance has set aside $6.34 billion in company funds to cover the losses, with about $5 billion already held in the same tokens that were taken.
• QCP, a trading firm, reports $3.64 billion in net outflows from Binance since withdrawals were turned back on over the weekend.

Who is blamed for the attack

Both Binance and Decrypt's reporting point to TraderTraitor, a hacking group linked to North Korea. The same group is blamed for the Bybit theft in February 2025.

The story of how attackers got in has changed since Friday. Binance first blamed a compromised laptop belonging to a DevOps engineer, then said it found "additional points of breach." On Ethereum, the attacker used 50 pre-signed authorizations to turn a Binance hot wallet into a contract that emptied itself. According to the reporting, this was a failure of Binance's own signing approvals, not of the Ethereum blockchain. No private keys, which are the secret codes that control a wallet, leaked. The attacker also wiped its tooling on the way out.

What Binance says

Binance CEO Richard Teng says the company covers every dollar from corporate funds and SAFU, an emergency fund the exchange keeps for user protection. He said $6.34 billion is already set aside. CZ, Binance's founder, said: "It hurts, but we survive." Withdrawals were turned back on over the weekend.

US regulators and investigators respond

CFTC Chairman Michael Selig, whose agency regulates derivatives in the US, told CNBC the hack "proves our exact point." He argued the real issue is that Binance and similar platforms are unregulated offshore exchanges without the same safeguards as US venues. He is proposing a "federal option" that would let offshore exchanges register with the CFTC and meet US cybersecurity standards. He also noted the breach came "from someone's laptop," not from a blockchain.

The FBI confirmed it is "working with public and private partners to assess its scope and coordinate investigative steps." The Secret Service has also opened a probe.

In a separate exchange, Elon Musk posted a grimacing emoji on a comment estimating $1 billion in losses. CZ replied: "Elon, have a lot of respect for you, but bad time to troll. Please stop." CZ also noted Binance's SpaceX shares, bought through its $500 million stake in the Twitter takeover, are now "worth more than a billion."

What is confirmed

• About $6.4 billion was stolen from Binance on Thursday, mostly within 20 minutes.
• The FBI and Secret Service have opened probes.
• Binance has set aside $6.34 billion and says users will be made whole.
• Friday's Bitcoin ETF outflows were $643.3 million, and October ended at −$515.9 million net.
• The CFTC chairman made his comments to CNBC.

What is still unclear

• The full entry point of the attack. Binance first named one compromised laptop, then said it found additional points of breach.
• The exact final loss figures may change as investigations continue.

Why it matters

The theft is the largest recorded in crypto, dwarfing the previous record set by the Bybit hack. It hit investor confidence hard: a single Friday session wiped out a month of gains for Bitcoin ETFs, and Ethereum ETFs had their worst month ever. It has also given US regulators fresh ammunition. The CFTC chairman is using the case to argue for direct oversight of offshore exchanges, and the FBI and Secret Service investigations could bring further developments.

What to watch next

Monday's ETF flows will be telling. If Friday's outflows continue, the reporting suggests the market pain may not be over. Binance also has to buy roughly $1.3 billion of Bitcoin, Ethereum, and BNB on the open market and over the counter to top off its reimbursement pool, according to the reporting. Updates from the CFTC, the FBI, and the Secret Service are also expected as the investigation moves forward.

Sources

• Decrypt — Morning Minute: Binance Hack Leads to Mass Outflows While FBI Opens Probe
• Decrypt — Binance hack: everything you need to know
• Decrypt — Bitcoin ETF investors exit after record Binance hack
• Decrypt — CFTC chair on why offshore exchanges need US oversight
• Decrypt — Secret Service and FBI open Binance hack probe
• Decrypt — Binance sets aside $6.34B to cover hack losses
• Decrypt — Elon Musk and CZ trade blows over SpaceX shares