Fed and OCC contact US banks after Binance’s $6.3 billion hack as crypto security checks widen

US regulators have reportedly started asking banks about unusual activity and service disruptions after Binance disclosed a $6.3 billion hack. For high-risk PSPs and banks with crypto exposure, the point is not the headline number alone; it is the fact that supervisors are now looking at custody, counterparty exposure and incident response.

1. Officials from the Federal Reserve and the Office of the Comptroller of the Currency (OCC) began contacting banks on Monday, Reuters reported on Thursday, citing people familiar with the matter. The reported questions focused on whether banks had seen “unusual activity” or service disruptions after last week’s incident.
2. Stefan Muehlbauer, head of US government affairs at CertiK, said the follow-up could lead to closer scrutiny of how banks manage crypto-related risks, including custody, counterparty exposure and incident response. “After an incident of this scale, it would be surprising if the Fed and OCC didn’t check in with the banks they supervise,” he told Cointelegraph.
3. Reuters also reported that banks have been reviewing security systems after the Binance hack to work out whether they could absorb or manage similar threats. One of the largest US banks reportedly had a cybersecurity team contact Binance within hours of the breach. Binance said it shared its publicly released incident report with all its banking partners and was not aware of any vulnerabilities affecting them.
4. Muehlbauer described the process as “how a maturing framework should work” and said it was “not a signal that regulators are pulling back from the industry.” That matters for banks and PSPs because supervisory attention is still there even after the Fed removed, in April 2025, a requirement for state member banks to notify regulators before engaging in crypto activities.
5. Binance said in its Nov. 3 incident report that about $6.34 billion in digital assets were affected by the attack on Oct. 29, with $2.85 billion frozen or intercepted as of the report. The exchange said the attack started with compromised software installed by an engineer in June, then escalated through social engineering, stolen credentials and malicious software used to access wallet systems and make unauthorized transfers.

For banks that offer crypto custody or payment services, this is the uncomfortable but familiar bit: the attack surface is not just the exchange’s core stack. It includes software supply chains, credentials, human access and the incident-response handoff between the exchange and its banking partners.