Show
The US Commodity Futures Trading Commission (CFTC) is seeking to bring crypto exchanges under a federal registration framework with cybersecurity and customer-protection requirements, as Chair Michael Selig pointed to Binance’s reported $6.3 billion security incident as an example of the risks facing offshore trading platforms.
Speaking to CNBC on Friday, Selig said the Binance incident reinforced the agency’s case for its proposed regulatory approach. He argued that offshore exchanges do not operate under the same safeguards as US-regulated markets and said the CFTC wants to offer platforms a route to register with the agency.
“This proves our exact point in proposing regulations for crypto markets earlier this month,” Selig said, referring to the incident. He added that registered exchanges would be subject to cybersecurity and security requirements similar to those applied in traditional US markets.
The comments come as Congress remains divided over the Digital Asset Market Clarity Act. After the Senate failed to advance the legislation on September 15, 2026, the CFTC has been pursuing measures it can take under its existing authority.
CFTC looks to establish a federal registration route
Selig said the agency is developing proposals that would allow crypto exchanges to register with the CFTC voluntarily. The agency cannot require every platform to join the framework, but registration would provide an option for exchanges seeking federal oversight.
In an earlier Bloomberg TV interview, Selig said the proposal was intended to strengthen customer protections and bring crypto trading closer to the regulatory standards applied in traditional financial markets. He also expressed disappointment that Congress had not advanced the CLARITY Act, which he said would have established a clearer regulatory framework and required exchanges to register with the CFTC.
The agency’s current effort comes amid continued disagreement among lawmakers over the division of regulatory responsibilities for digital assets. Without congressional action, the CFTC is looking at measures available under its existing legal authority.
Selig points to security risks beyond blockchain protocols
Selig said the Binance incident appeared to involve vulnerabilities in the exchange’s supporting infrastructure rather than a flaw in the blockchain or its smart contracts.
He referred to the possibility that an employee’s laptop had been compromised, allowing an attacker to gain access to internal systems. Binance’s initial investigation had also identified a potentially compromised DevOps engineer’s laptop as an entry point, although the exchange later disclosed additional breach points.
Selig said cyber incidents targeting non-blockchain infrastructure can affect both traditional financial markets and crypto platforms. However, he noted that digital assets can move more quickly and may be transferred through services such as Tornado Cash, which can complicate efforts to trace funds.
He said blockchain transaction records can still provide regulators with tools to follow asset movements, even when obfuscation services are used.
Binance details EIP-7702 exploit and recovery measures
Binance reported an estimated $6.3 billion impact from unauthorized outflows involving its hot wallets across Ethereum, Bitcoin, and Tron. The exchange initially suspended deposits and withdrawals while investigating the incident.
In an October 30 video posted on X, co-CEO Richard Teng said the investigation had identified additional breach points beyond the initially suspected employee laptop. He said the attacker exploited Ethereum’s EIP-7702 authorization mechanism to obtain on-chain execution approval over a Binance hot wallet, bypassing the exchange’s normal approval controls.
Teng also said a self-destruct mechanism removed some of the attacker’s tools and traces, complicating the investigation. Binance has not yet published a complete technical account of the incident and said it would release a post-mortem after verifying its findings.
The exchange said industry partners had frozen approximately $3 billion in affected assets. Separately, Teng said Binance had reserved more than $6.34 billion in company funds to cover the affected assets, including about $5 billion already held in the same tokens involved in the incident. Binance was acquiring the remaining assets through market and over-the-counter transactions.
Binance has said customers will not bear the losses and that it will use company funds and its Secure Asset Fund for Users (SAFU) to cover any shortfall. Binance.US was not affected. The exchange is also preparing an updated Proof of Reserves report, which Teng said was targeted for Monday. Binance has not identified the attacker publicly, and its investigation remains ongoing.
Attribution claims remain separate from Binance’s findings
Blockchain analytics firms Chainalysis and TRM Labs have assessed with high confidence that North Korea-linked TraderTraitor was responsible for the incident, according to the information provided by the firms. Their assessment reportedly draws on on-chain patterns associated with previous attacks, including the 2025 Bybit exploit.
Independent investigator ZachXBT also reported that funds linked to the Binance incident and a separate $388 million Bitget exploit had converged at the same address through THORChain. He said the overlap suggested the same actor could be behind both incidents.
ZachXBT noted that the Bitget exploit had been attributed to TraderTraitor. However, the movement of funds between addresses does not independently establish that the same group carried out both attacks. Binance has not publicly attributed the incident to any individual or group.
The attribution claims have not been confirmed by Binance. The exchange has said it is working with law enforcement and industry partners to trace the funds and investigate the breach.
Also Read: Crypto Market Cap Slides 4.6% to $2.59T as Binance Probes $6.3B Hack