Banks Face Crypto Security Checks After Binance's $6 Billion Hack

The record $6.3 billion Binance hack is giving banks a security warning at an awkward moment. With U.S. banks weeks away from being able to issue stablecoins, regulators are probing whether the same tactics could expose weaknesses in the banking system, while security experts say banks should tighten controls over who can move money and who holds critical keys before Jan. 18.

Supervisors from the Federal Reserve and the Office of the Comptroller of the Currency began calling banks earlier this week to ask about weaknesses, unusual activity and service disruptions after the Binance hack.

One bank told Reuters it had seen no disruptions. The Fed and the OCC declined to comment.

The calls reflect how much closer banks and crypto have grown.

The Fed withdrew guidance in April 2025 that had required state member banks to notify supervisors before starting crypto activities, and banks will be able to issue stablecoins once the GENIUS Act's rules take effect Jan. 18, 2027.

Banks already hold stablecoin reserves, process payments and offer custody, notes Chris Mack, CTO of crypto trading platform Quote.Trade, so regulators need to know whether the same attack could work against them.

"Simply put, banks have a lot of holdings at the crypto exchanges," says Michal Pospieszalski, CEO and CTO of AmericanFortress.

Most rely on large exchanges and other third parties rather than holding crypto themselves, he says, so a bank with much of its crypto at a hacked platform could face a serious problem.

Not everyone sees cause for alarm. "It is a check-in, not an emergency," says Marc Dumpff, founder and CEO of BTCNow.

Binance's own report, published on X on Tuesday, shows the attackers never needed to break the exchange's code. In September, a fake recruiter on a job site persuaded an engineer to download an "assignment" onto his work computer that hid new malware.

On Oct. 20, the hackers used an internal Binance AI tool to take control of two wallet engineers' machines. On Oct. 29, hot wallets began sending funds to the attackers at 8:05 p.m. UTC, and the last stolen transfer went through almost four hours later.

The FBI has blamed North Korea for the theft, the latest sign of crypto's worsening security problem.

For Yasmina Kazitani, chief operating officer of the Blockchain Game and Agentic Alliance, that method applies to any financial firm. Banks share the same weak points, she says, from engineers and contractors to outside parties with trading authority and access tokens left on laptops.