Fed and OCC Contact Banks About Unusual Activity After the Binance Hack

Federal Reserve and Office of the Comptroller of the Currency officials contacted banks on Monday, Nov. 2, to ask whether they had seen unusual activity or service disruptions tied to Binance's Oct. 29 security incident, Reuters reported Thursday, citing people familiar with the matter. The inquiries, as Cointelegraph summarized them, could be followed by closer attention to how banks manage crypto-related risks such as custody, counterparty exposure and incident response.

TokenPost, which also covered the contact, said the regulators asked banks specifically about disruptions linked to the incident. Binance has said the attack affected about $6.34 billion in digital assets, with roughly $2.85 billion frozen or intercepted by the time its incident report was released on Nov. 3.

Banks have been assessing the hack and checking their systems to determine whether they could absorb or manage similar threats, according to Reuters. The same reporting said a cybersecurity team at one of the largest US banks contacted Binance within hours of the attack. A Binance spokesperson told Cointelegraph that the exchange shared its publicly released incident report with all its banking partners and was not aware of any vulnerabilities affecting them.

The exchange's account of the breach gives the banks something specific to check. Binance's incident report, released Nov. 3, put the affected figure at about $6.34 billion in digital assets and said roughly $2.85 billion had been frozen or intercepted by the time of release, figures TokenPost also carried. The company has said it strengthened its security controls after the attack and brought in independent cybersecurity experts to review what happened.

Stefan Muehlbauer, head of US government affairs at the security firm CertiK, called the outreach "how a maturing framework should work" and said it is "not a signal that regulators are pulling back from the industry." He told Cointelegraph that after an incident of this scale it would be surprising if the Fed and OCC did not check in with the banks they supervise, adding that their mandate is to protect the financial system and understand where exposures sit. He said the inquiries could be followed by closer attention to custody, counterparty exposure and incident response, the three areas where banks hold the most direct exposure to an exchange failure.

The timing matters for how much supervisory reach the agencies still have. In April 2025 the Federal Reserve removed a requirement that state member banks notify regulators before engaging in crypto activities, saying it would continue overseeing those activities through its regular supervisory process, according to TokenPost. The change removed an advance-notice step while leaving federal supervision in place, that report said. A Federal Reserve spokesperson told Cointelegraph the agency had nothing to share about the reported inquiries, and Cointelegraph said it had not heard back from the OCC at the time of publication.

The outreach also follows a shift in how the Fed treats crypto activity at state banks. Before the April 2025 change, state member banks had to notify the central bank before starting crypto-related work; the removal of that step means the current checks run through ordinary supervision rather than a special filing queue. The Fed has not published guidance tied to this incident, and neither agency has confirmed the Reuters account directly.

Binance's Nov. 3 incident report said the attack began with compromised software installed by an engineer in June. Hackers later used social engineering, stolen credentials and malicious software to reach wallet systems and carry out unauthorized transfers, the exchange said.

Darren Williams, founder and CEO of the cybersecurity firm BlackFog, told Cointelegraph that the methods used in the attack pose risks to traditional banks, particularly those offering crypto custody and payment services. "Attackers no longer need to break encryption or steal private keys if they can compromise the trusted systems and people authorized to move money," Williams said. He warned that compromised employee devices, accounts or third-party services can move money without triggering alerts, and that the growing use of agentic AI in financial operations adds further risk. His priority, he said, is stopping unauthorized transactions and data exfiltration before assets leave the organization, not investigating the damage afterwards.