Binance founder Changpeng Zhao expressed gratitude to the U.S. Secret Service and federal agents after they helped freeze stolen cryptocurrency from last week’s massive exchange hack, which saw over $6 billion taken.
In a November 2 post on X, Zhao—popularly known as CZ—applauded federal agencies and industry partners for acting within minutes of the October 29 attack, highlighting how their quick response helped contain the damage and limit potential fallout across both crypto and traditional markets.
“Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets,”
Zhao wrote.
His remarks came shortly after a November 1 update from the Secret Service, where officials confirmed that active efforts to trace and recover the cryptocurrency stolen from Binance Global remain underway.
Secret Service Reports Major Fund Freeze Following Binance Hack
According to the Secret Service, federal agents teamed up with crypto industry partners right after Thursday afternoon’s breach, successfully tracking down and freezing a major share of the stolen funds.
While the agency held back the exact figure frozen during the initial operation, officials confirmed that ongoing efforts to recover the rest of the funds remain active.
Federal agents are operating alongside the FBI, IRS Criminal Investigation, the U.S. Attorney’s Offices for the District of Columbia and Central District of California, and multiple divisions within the Department of Justice.
The probe brings in the DOJ’s Computer Crime and Intellectual Property Section alongside its National Security Division, both actively assisting authorities as the stolen cryptocurrency is tracked down.
Blockchain intelligence firm TRM Labs separately calculated that attackers routed roughly $6.36 billion across 10 blockchain networks, with the vast majority of the funds being moved in under 20 minutes.
Investigators have since kept tracking the stolen assets across dozens of crypto wallets, while authorities asked exchanges and service providers to block any further unauthorized transfers.
Zhao praised the agencies for their ongoing support, noting how their swift action helped limit the fallout after the breach was carried out.
FBI Links $6 Billion Binance Theft to North Korean Cybercriminals
The FBI officially linked the attack to North Korean cybercriminals operating under the TraderTraitor moniker, who were named as the primary suspects behind the breach.
In its October 31 release, the agency pinned the massive theft on North Korea, pointing to state-backed hackers who stole over $6 billion in virtual assets from Binance around October 29.
Investigators collaborating with the Secret Service and IRS Criminal Investigation noticed the attackers swapping the bulk of the stolen assets into Ethereum as the laundering process was carried out.
The FBI expects the hackers to keep laundering the stolen crypto through decentralized finance tools and instant swap platforms, where assets can be exchanged without going through traditional centralized exchanges.
Federal authorities urged THORNode operators, RPC node operators, instant exchanges, DeFi protocols, and blockchain analytics firms to blacklist transactions coming from wallets that were linked to the theft.
The agency released a list of Ethereum addresses holding or having previously held the stolen crypto, identifying those accounts as being operated by or directly tied to TraderTraitor operatives.
The attribution aligns with findings from Chainalysis, which connected North Korean hackers to nearly 89% of all crypto theft losses recorded throughout 2026.
The October 29 breach stands as one of the largest crypto security incidents on record, far topping the nearly $1.5 billion that was taken from Bybit in February 2025.
Binance Strengthens Recovery Efforts and Customer Protection Measures
Binance reassured affected users that company resources and its Secure Asset Fund for Users will cover their losses, guaranteeing full reimbursement after the breach was carried out.
Binance’s preliminary investigation suggests that attackers compromised a DevOps engineer’s laptop, potentially granting them unauthorized entry to an internal service container that was used to process withdrawal requests.
Binance clarified that investigators found no evidence showing wallet private keys were compromised, adding that engineers immediately revoked the affected permissions while continuing to cooperate with federal agents.
The security breach sent immediate shockwaves through cryptocurrency markets, causing Bitcoin and major altcoins to plummet as more than $1.5 billion in positions were liquidated on October 30.
Binance temporarily paused user withdrawals following the breach while security teams ran system checks, ensuring all affected networks were thoroughly audited before full service was restored.
Binance pledged to cover all customer losses using its emergency insurance reserves and company funds, though the exact amount needed will depend on how much stolen crypto is recovered by investigators.
Meanwhile, the FBI requested information from anyone holding details regarding the attackers or transactions that were linked to the massive heist.
Individuals and cryptocurrency businesses can contact their local FBI field office or submit details through the agency’s Internet Crime Complaint Center, where tips are received by federal agents.
Federal authorities continued coordinating with cryptocurrency service providers to identify wallets associated with the heist, ensuring further movement of the stolen funds was effectively restricted.
