The $6.4 billion theft from Binance has become a central argument in the U.S. Commodity Futures Trading Commission’s push to place offshore crypto exchanges under federal oversight. CFTC Chairman Michael Selig told CNBC that the attack demonstrated why exchanges outside the United States should have access to a federal registration framework and be required to meet cybersecurity standards similar to those governing U.S. financial markets.
According to Decrypt, Selig said the hack “proves our exact point” behind crypto-market rules proposed by the CFTC earlier this month. He described the incident as a failure involving exchange infrastructure rather than a defect in Ethereum, the blockchain on which part of the attack occurred.
The comments give the CFTC a high-profile example to support its case for stronger supervision of digital-asset trading venues. Binance has said users’ assets are safe, while the Secret Service and FBI are investigating the incident. TRM Labs and Chainalysis have linked the theft to North Korea’s TraderTraitor group.
Selig’s case for a federal framework
Selig argued that the main regulatory problem is the operation of offshore exchanges without the safeguards required in U.S. markets. He said a “federal option” could allow such platforms to register with the CFTC and comply with federal cybersecurity requirements.
His argument comes as the agency advances its own cryptocurrency rulemaking instead of waiting for Congress to complete legislation. The CFTC has sent proposals to the White House that would classify event contracts as “swaps” and has also floated plans to bring crypto exchanges under federal oversight.
That approach reflects a broader shift in which regulators have moved forward with policy proposals while the Clarity Act remains stalled in the Senate. The Binance breach gives the agency a concrete example of the risks it says could be addressed through common federal standards.
What happened at Binance
Selig said the attack appeared to begin with a vulnerability introduced through an individual’s laptop, rather than by breaking Ethereum or one of its smart contracts. He compared the type of incident with breaches that can occur in traditional financial markets, but said crypto transactions can move more quickly and can be routed through services such as Tornado Cash to make tracking more difficult.
Binance’s own description has developed since the initial account. The exchange first pointed to the compromised laptop of a DevOps engineer. On Friday, however, Binance said its investigation had identified “additional points of breach.” Chief Executive Richard Teng described the incident as a more complex process that did not rely only on one engineer’s permissions.
The attack also involved Ethereum-based activity, even though investigators have not identified a weakness in Ethereum itself. The attacker used EIP-7702, an Ethereum feature that allows ordinary wallets to execute smart-contract code. That mechanism was used to turn a Binance hot wallet into a “sweeper,” with 50 pre-signed authorizations used to drain assets.
Blockchain analytics company TRM Labs said the wider incident indicated a compromise of Binance’s signing infrastructure, rather than a weakness in a blockchain network. Signing infrastructure is the system used to authorize transactions from wallets controlled by an exchange.
Traceability and the investigation
Selig said on-chain transaction records could give regulators an advantage. Although criminals may use tools intended to obscure the movement of funds, blockchain activity can still provide investigators with a record to follow.
He said the ability to trace transactions gives regulators the potential to monitor activity closely. That view formed part of his broader argument that crypto’s transparent transaction layer could support oversight, even when attackers attempt to hide the path of stolen assets.
Binance has set aside $6.34 billion to cover losses and has assured customers that their assets are safe. The theft has been described as the largest in crypto history. The FBI and Secret Service have opened investigations, while TRM Labs and Chainalysis have attributed the operation to TraderTraitor, a group linked to North Korea.
Moneyiar market picture
Moneyiar market data at the stated times shows BNB, Binance’s associated token, at $711.5134921781 as of November 1, 2026, at 12:43 p.m. Tehran time. BNB was up 0.88% over 24 hours but down 3.73% over seven days.
Other assets in the supplied data were mixed:
- Billions Network (BILL) was $0.0139971939, down 0.59% in 24 hours and up 10.04% over seven days, based on data from September 21, 2026, at 1:39 a.m. Tehran time.
- Loaded Lions (LION) was $0.0011347497, down 0.40% over 24 hours and 4.63% over seven days as of November 1, 2026, at 12:43 p.m. Tehran time.
- Ore (ORE) was $149.6788264277, up 9.65% over 24 hours but down 13.54% over seven days as of November 1, 2026, at 12:44 p.m. Tehran time.
The market figures describe price movements at those specific times and do not establish a cause-and-effect relationship with the Binance breach or the CFTC’s comments.
