Circle’s response to the Binance incident and the need for swift coordination among law enforcement, regulators and market participants.
The crypto ecosystem is confronting an incident of extraordinary scale. The reported attack on Binance appears to involve more than $6 billion in digital assets, with the FBI attributing blame to actors connected to the Democratic People’s Republic of Korea.
The investigation remains ongoing, and the facts will continue to develop. But the immediate lesson is already clear: digital asset-attacks are no longer isolated incidents affecting a single platform. They are dynamic, cross-border events that can move through multiple chains, venues, jurisdictions and intermediaries in seconds.
That reality demands a response capable of matching the speed and complexity of the threat.
Circle has long had a close working relationship with law enforcement and key stakeholders across the ecosystem. As part of that effort, Circle froze approximately $1.1 billion in USDC associated with the incident in coordination with law enforcement. We continue to work actively with relevant partners to identify affected funds, support investigative efforts and help address this rapidly evolving situation.
It is also important to distinguish a freeze from other legal proceedings. Circle respects private property rights and due process. When law enforcement obtains a valid court order to freeze a USDC wallet address, Circle freezes that address, preventing USDC from moving in or out of that address. Circle does not decide who owns the assets, whether USDC should be frozen or subject to forfeiture proceedings, or whether a crime occurred; those determinations belong to law enforcement and the courts. Our role is to act quickly on a valid legal process and support the investigation and recovery effort.
This response reflects one of the important characteristics of open blockchain systems: transaction activity can be analyzed and, in many cases, traced by law enforcement. Transparency does not prevent every attack. But it can make the movement of illicit funds observable, create opportunities for intervention, and help responsible actors limit the damage.
The events of the past days demonstrate that open systems performed an essential function. The networks continued to operate. Transaction activity could be analyzed. Responsible actors across the value chain – including exchanges, stablecoin issuers, blockchain analytics firms, custodians and law enforcement – were able to coordinate around a common objective: preventing stolen assets from being laundered or converted into further harm.
That is not a reason for complacency. It is a reason to strengthen collective defense.
We continue to encourage several actions.
First, law enforcement agencies around the world should deepen real-time coordination around digital-asset incidents. This was key in the industry’s response to the Binance exploit. Illicit actors do not respect national borders, banking hours or institutional silos. Investigators need reliable channels for urgent information sharing, rapid requests and coordinated action across jurisdictions. Public-private partnerships must be built before an incident occurs, not improvised after funds have begun moving.
Second, regulators should continue developing clear and consistent frameworks that allow responsible market participants to respond quickly to credible threats while preserving due process and the rule of law. Effective policy should recognize both sides of the challenge: open systems require accountability, but accountability is most effective when institutions have the legal clarity and operational tools necessary to act.
Third, market participants must treat cybersecurity and incident response as shared responsibilities. Exchanges, custodians, issuers, infrastructure providers and financial institutions should invest in stronger controls, continuous monitoring and rapid information sharing. No individual organization can see the entire threat landscape. Collective visibility is therefore a core component of market integrity.
The speed of this threat requires an equally speedy and globally coordinated response. When illicit funds can move across systems in minutes, a response that takes days may arrive after the opportunity to contain the damage has passed. An appropriate legal safe harbor, along with harmonized threat information sharing clear, legally bounded steps for freezing and seizing crypto assets, can keep systems open, market participants safe, and bad actors on the run.
The objective is not to eliminate openness from financial systems. Nor should a single criminal event be used to justify abandoning the innovation, transparency and user choice that open networks make possible. The objective is to ensure that openness is paired with responsibility - and that responsible actors have the ability to act decisively when open systems are abused.
Bad actors should not be permitted to externalize the highest costs of their actions onto law-abiding users, businesses and institutions. The integrity of the digital asset ecosystem depends on ensuring that those who build, operate and participate in it can defend it together.
This latest incident is a reminder that collective defense is no longer an aspiration. It is an operational requirement. Circle will continue working with law enforcement, regulators and market participants around the world to support that effort.
Open systems require open coordination. And when the threat moves at machine speed, the defense must move together.
