The FBI said it is “aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.”
According to Reuters, a person familiar with the response said Binance is working with law enforcement around the world, including the FBI and the US Secret Service, after hackers stole a record amount from the platform. The Secret Service did not reply to a request for comment that Reuters sent by email outside US hours. CNA carried the same Reuters dispatch, with Elizabeth Howcroft and AJ Vicens on the byline. In that file the bureau’s public statement leaves out the Secret Service, an attacker name, and a dollar total. The Secret Service detail sits only in the person’s account, and Reuters quotes no official of that service.
The BBC live page also carried an FBI comment: the bureau said it was aware of the incident and engaged with public and private partners on scope, impact, and investigative steps. The live blog placed that comment after Binance said it was working with law enforcement.
Thursday’s report, Friday’s impact update, and the recovery piece already cover the roughly $6.3 billion hot-wallet theft, the freeze work, and the company funds Binance set aside.
A Financial Conduct Authority spokesperson told the BBC: “While Binance wasn’t registered with the FCA to provide crypto services in UK, we’re aware of the reported incident and engaging with them to understand the impact.”
According to the BBC, the FCA does not regulate cryptocurrencies the same way it regulates traditional finance products, though firms that advertise or sell crypto-assets must still meet some of its rules. Binance is not registered or authorised with the FCA. In 2021 the regulator imposed requirements on Binance’s UK arm so it could not carry out regulated activity without FCA approval. In 2023 the exchange stopped accepting new UK retail customers. Existing users can still reach some services on the global platform, the live blog says, without listing which services those are.
In a video statement on X covered by the BBC, Binance co-CEO Richard Teng said the attacker used a known multi-signature path tied to EIP-7702 to obtain on-chain execution approval over a hot wallet, and that the delegation did not pass through the firm’s normal approval controls. That, he said, is why the withdrawal service needs to stay paused while investigations continue. Binance is rebuilding the withdrawal service and will not switch it back until it “passes rigorous testing,” Teng said, adding that the company is “on track” to resume services within about 40 hours. Withdrawals had not been confirmed resumed when this piece was filed. He also said the company is conducting a full security review and completing the purchase of remaining assets to cover losses. Binance will share a full proof-of-reserves report by Monday, he added, and aims to give an initial view before that.
Teng’s video, as the BBC reported it, also said the initial idea that hackers entered only through a developer’s laptop is incomplete. “This was not carried out by one person,” he said, according to the live blog. Later investigation found more than a single laptop path, he said, without naming those other points in the clip the BBC quoted.
In its security notice, Binance had already said it engaged law enforcement and blockchain intelligence partners, revoked affected address authorisation, and temporarily suspended withdrawals while deposits continued as normal. It also said it would cover losses from its SAFU fund and company funds. That notice does not name the FBI, the Secret Service, or the FCA.
