CFTC Chair Cites $6.4bn Binance Hack in Push for US Oversight of Offshore Exchanges

The chairman of the US Commodity Futures Trading Commission has seized on the roughly $6.4bn theft from Binance, the largest hack in crypto history, as evidence that offshore exchanges should be brought under American supervision.

Michael Selig told CNBC on Friday that the breach vindicated the crypto-market rules his agency proposed earlier this month, saying it "proves our exact point".

A federal option for offshore venues

Selig's central argument is that the problem lies less with the technology than with where the exchanges sit. Offshore platforms, he said, operate without the protections that are standard in US financial markets.

His proposed remedy is what he called a "federal option": a route by which such venues could register with the CFTC and accept the same cybersecurity requirements that apply to regulated American markets. The approach is framed as voluntary registration rather than an outright mandate, at least in the way Selig described it.

The idea reflects a familiar tension in crypto regulation. Many of the largest trading venues serve a global customer base from jurisdictions outside the US, and American regulators have long struggled to apply domestic standards to them. Offering a formal path into the US system is one way of drawing such firms closer to federal oversight without waiting for legislation.

How Selig described the attack

Selig was keen to separate the breach from the blockchain on which it took place. According to his account, the exploit did not compromise Ethereum or its smart contracts. Instead, he said, he believed the vulnerability originated on an individual's laptop, the sort of security lapse that can afflict traditional financial firms just as easily.

Where crypto differs, he argued, is in the speed with which stolen funds can move. Attackers can shift assets rapidly and pass them through mixing services such as Tornado Cash to make them harder to follow.

Yet Selig also presented the public nature of blockchains as an asset for enforcement. Because transactions are recorded on-chain, he said, regulators retain considerable ability to trace funds even when obfuscation tools are used, giving them scope to act as an effective watchdog.

A more complicated picture

Selig's summary of the incident may not capture its full scope, as Decrypt reported. Binance at first attributed the breach to a compromised laptop belonging to a DevOps engineer. By Friday, however, the exchange said its investigation had found further points of entry.

Chief executive Richard Teng described a more elaborate operation that went beyond the misuse of a single engineer's access permissions. That shift matters for the policy debate: an attack that exploited multiple weaknesses in an exchange's internal systems is a different proposition from one traced to a single careless device.

The technical details also complicate the claim that the blockchain played no part. While Ethereum itself was not shown to be flawed, the attack partly unfolded on-chain. The attacker used EIP-7702, an Ethereum feature that allows ordinary wallets to execute smart-contract code, to convert a Binance hot wallet into a so-called sweeper. Using 50 pre-signed authorisations, the attacker then drained the wallet's assets.

Hot wallets are the internet-connected accounts exchanges use to process day-to-day withdrawals, and they are typically a prime target because they must remain accessible. A sweeper configuration automatically moves funds out as soon as they arrive, effectively turning the wallet against its owner.

Blockchain analytics firm TRM Labs said the wider breach pointed to a compromise of Binance's signing infrastructure, the systems used to authorise transactions, rather than any weakness in a blockchain. That assessment broadly supports Selig's distinction between protocol and operator, even if the mechanics involved native blockchain features.

Scale of the losses and the investigation

Binance has set aside $6.34bn to cover the losses and has told users their assets are safe. The size of that reserve underlines both the scale of the theft and the exchange's capacity to absorb it, something few platforms could match.

The US Secret Service and the FBI have opened an investigation. TRM Labs and Chainalysis have linked the theft to TraderTraitor, a hacking group associated with North Korea.

The attribution adds a national-security dimension to what might otherwise be treated as a corporate security failure. State-linked groups have been repeatedly connected with large crypto thefts, and the involvement of federal law enforcement agencies signals that Washington views the incident as more than a private matter between an exchange and its customers.

Regulators moving ahead of Congress

Selig's remarks build on an argument he has been advancing for several weeks. Rather than wait for lawmakers, the CFTC has pursued its own crypto rulemaking.

The agency has sent the White House proposals that would classify event contracts as swaps, a step that would place them more firmly within its jurisdiction. It has also floated a plan to bring crypto exchanges under federal oversight.

This activity forms part of a broader pattern in which regulators have taken the initiative after the Clarity Act, legislation intended to set out a framework for digital asset markets, stalled in the Senate. With Congress unable to agree a statutory regime, agencies have sought to fill the gap through rulemaking and guidance.

That approach carries trade-offs. Agency rules can be adopted more quickly than legislation, but they can also be revised by future leadership and may face legal challenges over the limits of an agency's authority. A clear statutory mandate would generally give rules firmer footing.

The Binance breach gives the CFTC a high-profile example to support its case. Large, dramatic incidents have historically shaped financial regulation, and a record theft linked to a foreign state is likely to sharpen the political appeal of tougher cybersecurity standards.

Counterpoints and open questions

There are reasons for caution in drawing a straight line from the hack to the CFTC's proposals. If the breach involved several points of compromise inside Binance's systems, it is not obvious that any single set of cybersecurity rules would have prevented it. Regulated firms in traditional finance also suffer serious breaches.

The voluntary character of a federal option raises another question: whether offshore exchanges would choose to register at all, and what would happen to those that decline. The incentive structure behind registration will determine how much difference the plan makes in practice.

There is also the matter of jurisdiction. Expanding the CFTC's reach over crypto venues is likely to draw scrutiny over which agencies should oversee which parts of the market, a dispute that has slowed progress on legislation.

Key points to watch in the coming weeks include:

• Further disclosures from Binance on how the attackers gained access to its signing systems
• Progress of the Secret Service and FBI investigation and any recovery of funds
• The White House response to the CFTC's event contract and exchange oversight proposals
• Whether the hack revives momentum for the Clarity Act in the Senate

For now, Selig has made clear that the CFTC intends to use the episode to press its case. Whether the incident translates into concrete rules, and whether those rules would address the specific failures at Binance, remains to be seen.