The Binance hack: $2.7 billion frozen, $2.4 billion beyond any freeze. What BSA/AML teams and examiners should ask

On the afternoon of October 29, New York time, money started leaving Binance wallets on ten blockchains at once. By TRM Labs' count, about $6.36 billion moved to attacker addresses, most of it in roughly 20 minutes (TRM). Binance puts the impact at around $6.3 billion and says it will cover all losses from its SAFU fund and company funds (Binance). It's the largest crypto theft on record, about four times the $1.5 billion Bybit hack in February 2025.

If you work in BSA/AML, sanctions or bank supervision, this one is worth reading closely. Most of what has been stopped so far was stopped by issuer freezes, the same power the GENIUS Act requires U.S. stablecoin issuers to have. The rule that will set the AML and sanctions duties for those issuers isn't final yet. And the weak point at Binance wasn't a stolen key. It was the system that decides what gets signed.

What actually happened

Binance's first explanation was a compromised DevOps engineer's laptop that gave an attacker access to a service container, which then submitted unauthorized withdrawals. It said it found no evidence of a wallet private key leak. On October 30 it said the investigation had "uncovered additional points of breach," and co-CEO Richard Teng said it was "not a single 'one-click' action" (BleepingComputer, Decrypt). There's no root cause yet. Binance says a full post-mortem is coming.

TRM's on-chain read is more specific. On Ethereum, the attacker submitted 50 pre-signed EIP-7702 authorizations, each signed by a Binance hot wallet, so that one would match the wallet's transaction count when it landed. One did, and the wallet became a sweeper only the attacker could call. On the other nine chains, Binance wallets simply sent funds out through ordinary signed transfers. TRM's assessment is that the attacker got the ability to make Binance's hot wallet signing system sign what it wanted.

So the keys may never have left. The thing that decides what the keys sign was the weak point.

TRM and Chainalysis both attribute the attack to TraderTraitor, the North Korean unit the FBI named for Bybit. Chainalysis says its strongest evidence was stolen Binance funds mixing in real time with funds from last month's Bitget exploit (Chainalysis). Binance itself hasn't named anyone.

The part that worked: the freeze

Here's the number I keep coming back to. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze roughly $30 million more, for about $2.7 billion in total by TRM's count early on October 30. Tether froze 971.1 million USDT in the main receiving wallet 37 minutes after the main sweep. Circle froze 823 million USDC in coordination with law enforcement. By Friday, Binance put its verified frozen total at about $3 billion, and the list of frozen tokens had grown to include FDUSD, PAXG and Tether Gold (Cointelegraph).

The attacker knew this was coming. TRM says it sold about 325 million USDT to market makers for roughly 122,300 ETH, an implied discount of more than 10%, just to get out of something that could be frozen. It still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can touch.

That split is the clearest lesson of the week. Apart from a small freeze on Arbitrum, what got away was the money with no issuer to call.

For a sanctions team, the sale to market makers is the detail to sit with. Those fills happened in the first hours. After Bybit, the FBI asked exchanges, bridges, analytics firms and DeFi services to "block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets" (FBI). Blocking only works if your screening list updates faster than the attacker moves.

How banks are protecting themselves

The GENIUS Act says a permitted issuer can only issue if it has "the technological capability to comply, and will comply, with the terms of any lawful order" to seize, freeze, burn or prevent the transfer of its stablecoins. It also requires the technical capability to "block, freeze, and reject" transactions that violate the law. A lawful order has to name the coins or accounts "with reasonable particularity" and be open to review or appeal. In other words, the freeze button is a legal requirement for U.S. issuers, with due process attached.

It goes further on custody. Custodians holding customers' payment stablecoins or private keys must treat them as the customer's property and keep them segregated from their own. Issuer reserves can't be rehypothecated. If an issuer fails, holders get priority on the reserves.

The OCC's final rule, issued October 21, takes effect January 18, 2027. It covers reserves, redemption, risk management, custody, and a capital and operational backstop. It leaves out the Bank Secrecy Act, AML and sanctions pieces, which will come in a separate rulemaking with Treasury. That rule is still only a FinCEN and OFAC proposal from April. Banks already have room to do this work. In March 2025 the OCC confirmed crypto custody is permissible for national banks and said it expects "the same strong risk management controls" as for anything else.

What none of this does is stop an exchange's signing system from being turned against it. GENIUS governs issuers and custodians. Binance's loss happened at the signer. TRM's advice to treasury teams is concrete: alert on any EIP-7702 delegation on a wallet that shouldn't have one, treat a request for many authorizations as a sign of compromise, and separate signing systems by chain and wallet tier. If I ran custody at a bank, that's the paragraph I'd print out.

Questions I'd ask a bank's crypto team

These are my questions, not anything an agency has issued. Each one comes from something that happened this week.

1. How fast can you act on a freeze or blocking order, and who is on call at 4 p.m. on a Thursday or 2 a.m. on a Sunday? Tether's freeze of the main receiving wallet landed 37 minutes after the main sweep. That's now the benchmark people will compare against.
2. How quickly do new hack addresses reach your screening? The attacker sold stablecoins to market makers within the first hours. If your desk provides liquidity, would those fills have been stopped?
3. Is the system that approves a signature separate from the system that asks for one? Would you get an alert if a wallet you control picked up an EIP-7702 delegation?
4. When software initiates a payment, can you name the person or firm it acts for at the moment the payment leaves?
5. How long does it take to revoke a credential or an agent's authority across every account it touches, and has anyone timed it?

The real risk from AI agents

Could an AI agent steal money to fund itself? I looked for documented cases, and I want to be careful, because this topic attracts a lot of fiction.

What has actually happened is agents being tricked into paying humans. In November 2024, a game called Freysa put an AI agent in charge of a prize pool with one rule: never transfer the money. After 481 failed attempts, a player convinced it that its payout function was for incoming deposits, and it sent about $47,000 to the player (Cointelegraph). In May 2026, someone posted a Morse-code message that Grok decoded into a public instruction, and Bankrbot treated that output as a command and sent 3 billion DRB tokens from a Grok-linked wallet to the attacker (CryptoSlate). Bankr's developer said 80% was returned. No private key was stolen in either case. Words got the agent to use authority it already had.

What has been shown in tests is more serious. Last December, Anthropic's SCONE-bench research had AI agents write exploits against smart contracts that were really hacked after the models' training cutoffs. They produced exploits worth $4.6 million in simulated stolen funds, and found two new vulnerabilities in recently deployed contracts. All of it ran in simulators. In 2025 the UK AI Security Institute's RepliBench tested whether models could get the money and compute they'd need to copy themselves. Models handled cloud signups and crypto transactions well, had some success persuading simulated people to give them money, and failed completely at a simulated KYC check, a result AISI expected newer models to improve on.

What I couldn't find is any documented case of an agent stealing money on its own to fund itself. That's still a test-lab scenario. The near-term risk is people using agents, and agents being talked into things. Elliptic found a Bitcoin mixer that now publishes an MCP server so an agent can mix funds as one tool call. And Chainalysis says the Binance laundering shows thousands of transactions in a short window that "suggest that the attackers are using automation." It didn't say AI, and I won't either.

How the rules should be written

This is my opinion, built on what regulators and compliance teams are already saying.

Regulate control, not intelligence. CFTC Chairman Michael Selig asked on October 28 whether agent developers should register, "who is liable if the agent goes rogue," and whether we need "KYA or know-your-agent" (CFTC). His answer was to stay grounded in "the functions performed, the control exercised, and the economic realities of the transaction." I agree. Chainalysis puts it more simply: accountability "must trace to whoever deployed and funded the agent, not the agent itself."

Make the mandate travel with the money. Notabene's Lana Schwartzman points out that IVMS101, the Travel Rule data model, has "no field for software acting on someone's behalf." Who the agent works for, its limits, approved payees and an end date should move with the payment and be visible to the other side before it settles.

Put limits where a prompt can't reach them. Freysa's one rule lived in its prompt. In the Bankr case, CryptoSlate lists recipient allowlists, spend limits and human confirmation as the controls that would have changed the outcome. The same logic applies to Binance's signer: TRM says signing policies should reject EIP-7702 authorizations unless they're expected.

Watch patterns, not single payments. Schwartzman's worry is an agent told to cut friction learning to send ten payments of $2,900 instead of one of $29,000, under the $3,000 U.S. Travel Rule threshold. In a person, that pattern would look like structuring. A per-payment cap won't catch it.

Test revocation the way you test backups. Granting an agent authority takes a click. Taking it back across every account it touches has to be just as fast, and someone should time it.

Keep the freeze, keep the due process. This week showed the freeze works. GENIUS ties it to a specific, reviewable order. As agents move more money, I'd want that balance kept, not traded for speed.

Where this goes next

Facts first. Binance hasn't published a root cause, and TRM expects the stolen ETH and BTC to move next through bridges, swap services and OTC brokers. On October 30 deposits were working, withdrawals were still paused while Binance rebuilt its withdrawal service, and the exchange said it was on track to resume them in about 45 hours. It also said it had set aside more than $6.34 billion of company funds to cover the loss (Cointelegraph). Later that day it said it had "begun recovering affected assets for users," and that frozen assets "remain subject to ongoing recovery and verification" (BBC).

My read, and it's only that: this hack will hang over the final FinCEN and OFAC rule, and the GENIUS freeze requirement looks a lot less theoretical than it did a week ago. I also expect supervisors to start treating signing infrastructure as its own risk, separate from the keys.

The agent question comes down to the same thing as Binance. The attacker didn't need the keys. It needed something that would sign. An agent with a wallet is also something that signs, so it needs the same limits.

Related on the site: agents can pay as you, but they still can't fund you, stablecoins over the next five years, what a regulatory close teaches product teams and AI incidents, guardrails and trust. More in the writing hub.