Trump Says US Is Investigating Binance Hack as Calls Grow for CFTC Rules

Published October 31, 2026, 02:50 AM PKT. Based on The Block's October 30, 2026 report of President Donald Trump's press conference remarks and Commodity Futures Trading Commission Chair Michael Selig's CNBC interview, The Digital Chamber's October 30, 2026 letter to House and Senate leadership, Bloomberg and Associated Press accounts of Trump's remarks on the North Korea question, and background from MABOnChain articles 394 to 402 on the Binance hack. This is a follow-up, not a new hack report: the theft itself, estimated at about $6.3 billion, was covered on October 29 and 30, and the new development is the US political and regulatory response on October 30.

President Donald Trump said on October 30, 2026 that the United States is examining whether North Korean hackers were behind the estimated $6.3 billion Binance hack, the largest theft in crypto history. Asked about a North Korean connection in his Friday remarks, Trump answered, according to Bloomberg and Associated Press accounts of the exchange, "We don't know. We're looking at that." He added, in remarks carried by Real America's Voice, that Binance had told US officials the situation was under control, saying, "they say they have it pretty much under control. We'll see." At a press conference on Friday afternoon, Trump also said he was looking into the hack and that Binance has said it is ensuring customers get their funds back, according to The Block. "But it's a hack," Trump said, according to The Block. "That's the problem. I've always felt it was a little bit dangerous." The remarks are the first public comments from the president on the Binance theft, and they arrived a day after the attack, which Binance said drained about $6.3 billion from its hot wallets in a matter of hours on October 29.

We don't know. We're looking at that

The most important limit on Trump's remarks is what they did not do. Trump did not confirm that North Korea was responsible, did not name any attacker, and did not present new technical evidence about how Binance was breached. That leaves the official US position open, and it stands apart from the private sector attribution already on the record. Blockchain analytics firm TRM Labs has attributed the attack with high confidence to TraderTraitor, a North Korean hacking group, based on its on-chain and off-chain intelligence, with an initial estimate of about $6.36 billion stolen. Chainalysis has also pointed to North Korean-linked actors. Those are private assessments, not a US government finding, and Trump's answer neither confirmed nor contradicted them. Readers should also not read the earlier US attribution of the February 2025 Bybit theft, worth about $1.5 billion, to the same group as a finding about Binance. It was a separate case. The distinction matters because an official attribution, if it comes, would carry diplomatic and sanctions consequences that a private firm's assessment does not, and because the freeze and recovery effort so far rests on company statements and on-chain action by issuers, not on a published government case.

Selig: the hack proves the CFTC's point

Commodity Futures Trading Commission Chair Michael Selig used the hack on October 30 to press the agency's case for federal oversight of crypto exchanges. "This proves our exact point in proposing regulations for crypto markets earlier this month," Selig told CNBC on Friday, according to The Block. "The real issue here is that these are unregulated offshore exchanges, and they don't have the same safeguards that we have in our financial markets here in the United States." Selig pointed to Binance not being federally regulated by his agency as the core issue. On October 5, the CFTC proposed its federal framework for crypto, covering leveraged and margined retail crypto trading and a new registration category for exchanges offering those products. Selig's argument, as reported, is that the hack shows what happens when a venue of Binance's size sits outside that perimeter, without the custody, capital and operational standards that federally regulated markets must meet. What Selig did not announce was a new enforcement action against Binance, a new rule taking effect, or a mandatory registration requirement. The CFTC cannot impose a blanket registration mandate on spot crypto exchanges on its own. Only Congress can do that, which is why Selig's remarks landed as an argument to lawmakers as much as a statement to markets.

The Digital Chamber's letter to Congress

The industry's own lobbying arm moved the same day, and in the same direction. On Friday, October 30, The Digital Chamber chief executive Cody Carbone sent a letter to House and Senate leadership demanding that Congress immediately pass a bill giving the CFTC authority over crypto exchanges, according to The Block and CryptoTimes. The letter was addressed to House Speaker Mike Johnson, Senate Majority Leader John Thune, House Minority Leader Hakeem Jeffries and Senate Minority Leader Chuck Schumer, according to CryptoTimes. It asked for three things: customer asset protection, federal oversight of spot digital asset markets, and cybersecurity requirements. On customer funds, the letter demanded that customer funds and company funds be kept separate from each other in bankruptcy proceedings, so customers are not treated as unsecured creditors if a platform fails. On oversight, it called for giving the CFTC registration, examination and enforcement authority over US spot digital commodity exchanges, brokers and dealers, pointing to the Senate Agriculture Committee's Digital Commodity Intermediaries Act as a starting point. "No federal regulator can set and enforce consistent standards for how these platforms hold, segregate, and secure customer assets, or for their cybersecurity, before consumers are harmed," Carbone wrote. "Regulators can only act after the damage is done." He closed with a deadline of sorts: "We urge you to act before this Congress adjourns." The letter asks Congress to move on targeted exchange legislation rather than wait for the broader digital asset market structure bill, which has stalled.

The Clarity Act fight, in one exchange

Whether the stalled Clarity Act would even have changed the outcome became its own argument on October 30, fought in public posts. Senator Cynthia Lummis, Republican of Wyoming and one of the bill's negotiators, wrote on X that the bill would have helped freeze the stolen funds faster. "Yesterday, hackers stole more than $6 billion from Binance in less than 4 hours, the biggest heist in history," Lummis wrote, according to The Block. "The Clarity Act would have given crypto firms legal cover to freeze suspicious transactions the instant law enforcement calls. Every minute lost is money gone for good." Amanda Fischer, policy director and chief operating officer for Better Markets and a former chief of staff at the Securities and Exchange Commission, pushed back, saying the bill would have required stablecoin issuers to freeze only per a court order, while crypto firms worked as quickly as they could to freeze assets. Solana Policy Institute general counsel Patrick Wilson disputed that reading, saying a section of the Clarity Act expressly protected stablecoin issuers from private lawsuits for voluntary, temporary holds based on a reasonable belief of a violation of law, and that no court order was required. The bill itself passed the House last year and has since stalled in the Senate, amid concerns over Trump's crypto wealth, which The Block reports had grown to hundreds of millions of dollars linked to World Liberty Financial and his TRUMP memecoin. Representative Tom Timmons, Republican of South Carolina, added a national security argument on X, writing, "America cannot allow rogue regimes to exploit digital assets to finance their nuclear weapons and ballistic missile programs." The exchange shows why the hack is now a legislative event as well as a security event: each side is using the same $6.3 billion theft to argue for a different version of the rules that would govern the next one.

What has not changed: no US attribution, no new deadline

For all the political reaction, the operational facts from Binance itself did not change on October 30 in any way Trump addressed. Binance co-chief executive Richard Teng said in a video on October 30 that the attacker used Ethereum's EIP-7702 authorization mechanism to obtain on-chain execution approval over a Binance hot wallet, bypassing the exchange's normal approval controls, and that a self-destruct mechanism removed some of the attacker's tools and traces, as reported in MABOnChain article 402. Binance has said it has reserved more than $6.34 billion in company funds to cover losses, with $5 billion already held in the affected tokens, and that it is buying back stolen altcoins to complete an updated proof of reserves, as reported in article 401. About $3 billion in stolen assets has been frozen on-chain with help from industry partners, including freezes by stablecoin issuers Tether and Circle. Teng said Binance aims to resume withdrawals within about 40 hours before a Sunday deadline and publish a full proof of reserves report on Monday, with preliminary data earlier. Trump supplied no new withdrawal deadline and no independent confirmation of that timetable, and Binance has still not said how the attacker obtained the EIP-7702 authorization, has not established the full attack path, and has not attributed the attack to any individual or group. The hack's history also frames the politics: in 2023, Binance's previous chief executive Changpeng Zhao pleaded guilty to failing to implement adequate anti-money-laundering controls at Binance as part of a $4 billion settlement, and he was later pardoned by Trump, according to The Block. That record is why both parties have expressed concerns about Binance over money laundering and consumer protections, and why calls are now growing both for legislation and for firms like Binance to move onshore, under a regulator that can set standards before the next breach rather than after it.

This article is news reporting and is not investment advice.

Sources

• The Block, President Trump says they're looking into Binance hack as calls grow for crypto rules (published October 30, 2026, primary reporting for Trump's press conference remarks, Selig's CNBC interview, the Digital Chamber letter, the Clarity Act debate, and the 2023 Zhao settlement background)
• The Digital Chamber, October 30, 2026 letter to House and Senate leadership from chief executive Cody Carbone (primary source for the letter's demands on CFTC authority, customer asset segregation in bankruptcy, and cybersecurity standards, and for the call to act before the 119th Congress adjourns)
• Bloomberg, account of Trump's October 30 remarks on the North Korea question, as carried in October 30 news flashes (secondary source for Trump answering "We don't know. We're looking at that" on whether North Korean hackers were responsible)
• Associated Press, account of Trump's October 30 Oval Office exchange on the North Korea question (secondary source, via CoinScreamer's October 30 report, for US authorities still examining the possible North Korean link and for Trump's "they say they have it pretty much under control. We'll see" remark)
• CoinScreamer, Trump on Binance Hack's North Korea Link: "We Don't Know" (published October 30, 2026, secondary source for the distinction between TRM Labs' private-sector TraderTraitor attribution and the absence of a US government attribution, and for the $6.34 billion reserve and Sunday withdrawal and Monday proof of reserves timetable)
• CryptoTimes, Digital Chamber Urges Crypto Exchange Oversight After Binance Hack (published October 30, 2026, secondary source for the letter's addressees and its three areas for congressional action, and for the Senate Agriculture Committee's Digital Commodity Intermediaries Act as a starting point)
• MABOnChain, Binance Teng Confirms EIP-7702 Role in $6.3B Hack, Targets Sunday Withdrawals and Monday Reserves (October 30, 2026, background for Teng's EIP-7702 account, the self-destruct mechanism, and the Sunday and Monday targets)
• MABOnChain, Binance Reserves $6.34B to Cover Hack Losses, Buys Back Stolen Altcoins (October 30, 2026, background for the $6.34 billion reserve, the $5 billion already held in affected tokens, and the roughly $3 billion frozen on-chain)