Binance's record-setting security breach has spilled into US bank supervision after the Federal Reserve and the Office of the Comptroller of the Currency began calling lenders on Monday morning, four days after attackers drained roughly $6.3 billion from the exchange.
According to Reuters, supervisors asked whether banks had seen any unusual activity or service disruption following the Binance hack. So far, the answer has been no, but the calls mark the first time a crypto theft has been treated as a question for the banking system rather than as an isolated crypto problem. One bank source said its staff prepared customer talking points and has fielded few questions, while lenders run their own diagnostics on whether they could withstand a similar attack.
The private sector moved faster: within hours of the attack, a cybersecurity team at one of the largest US banks contacted Binance counterparts. Its internal report is expected to trigger a review of the bank's systems and possibly a round of cybersecurity updates.
Regulators and banks are particularly worried about evolving artificial intelligence tooling. Binance's incident report traces the breach to June, when a wallet engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool, and to October 20, when attackers used an internal AI tool to move laterally onto two more engineers' machines. A fake job interview and malware-laced coding assignment were part of the initial compromise. Binance has also said it blocked 57 suspected North Korea-linked attacks before this one landed, and North Korea has denied involvement.
In a separate security step on Thursday, Binance removed all API keys linked to SignalPlus after the Hong Kong-based crypto options and derivatives platform reported a potential security issue. Binance described the removal as an immediate precautionary measure, said its own systems were unaffected and user funds remain safe. Users who traded through SignalPlus were urged to review positions and open orders directly on Binance, wait for SignalPlus to confirm the issue is resolved, and enable IP whitelisting before reconnecting.
The exchange also called on all third-party platforms integrated with Binance to review security controls and report unusual activity. The move came about a week after the October 29 hack, which the FBI attributed to North Korean hackers known as TraderTraitor. Binance said Wednesday it has replenished about 98% of the stolen assets from its own funds and is still buying the rest, mostly less liquid tokens, through market and over-the-counter channels. It has taken a new proof-of-reserves snapshot covering 44 tokens, up from 10, and expects the zero-knowledge proof to be verifiable in about 50 to 60 hours. Withdrawals are being reopened in phases, and deposits remain open.
The regulatory context matters: the OCC withdrew from the 2023 interagency joint statements on March 7, 2025, and the Federal Reserve followed on April 24, 2025. Eighteen months later, there was no equivalent reporting channel in place when supervisors wanted answers about the Binance hack. Democrats took both chambers this week, and Reuters reported that banks expect tighter oversight from the new Congress. The new Congress will not be seated until January 3, so any near-term supervisory guidance would likely come from the Fed or OCC before then.
