U.S. federal agencies have formally joined the investigation into the $6.4 billion hack of Binance, while the CEO of OneKey warned that BlackRock’s iShares Bitcoin Trust (IBIT) — the world’s largest spot Bitcoin ETF — could be the next target for North Korean attackers.
According to Reuters, Binance is cooperating with the FBI and the U.S. Secret Service. The FBI confirmed it was assessing the scope and coordinating steps with public and private partners; the Secret Service did not comment. The exchange said it had reserved more than $6.34 billion to cover losses via company funds and its Secure Asset Fund for Users, and that approximately $3 billion had been located or frozen with help from partners. Withdrawals remained suspended while Binance reviews its security infrastructure, with resumption targeted by Sunday.
Circle froze approximately $823 million in USDC tied to the attack, and Tether froze another $975.1 million in USDT. Circle CEO Jeremy Allaire said the company was coordinating with law enforcement. Blockchain intelligence firms TRM Labs and Chainalysis attributed the theft to TraderTraitor, the North Korean group previously linked to the $1.5 billion Bybit hack in February 2025.
OneKey founder and CEO Yishi Wang said BlackRock’s IBIT is likely on North Korea’s shortlist. IBIT holds roughly 815,000 BTC worth nearly $63 billion, with Coinbase as sole custodian. Wang estimated that a Binance-scale attack would equal about 9.5% of IBIT assets and could translate into losses of roughly $4 per share for investors. He emphasized that unlike USDT or USDC, stolen Bitcoin cannot be frozen by a centralized issuer, making recovery much harder.
Wang also warned that Coinbase’s crime insurance covers $320 million across customers, while custody agreements limit liability to $100 million per cold storage address — potentially leaving BlackRock investors exposed to losses above available coverage. He urged continued security checks and said large custody pools become increasingly attractive to attackers.
The Binance investigation follows Operation Atlantic in April, a joint effort involving the Secret Service, the U.K.'s National Crime Agency, Binance, Coinbase, and other crypto firms that identified more than 20,000 approval phishing victims, traced $45 million in stolen funds, and froze $12 million.
