A widely circulated account of Binance's cooperation with American investigators makes a reasonable point about enforcement and a demonstrably wrong one about scale. Separating the two matters, because the second is being repeated as fact.
The statement at the center of it
Changpeng Zhao, the founder and former chief executive of Binance, used his account on X to thank three American agencies — the Federal Bureau of Investigation, the United States Secret Service, and the Internal Revenue Service — for their role in tracking and freezing funds stolen from Binance. The post, whose exact publication date could not be independently confirmed at the time of writing, frames the cooperation as a model: exchanges hand over intelligence, investigators apply legal pressure, and assets are recovered before they can be liquidated into the open market.
The statement is unremarkable as a piece of public relations, and that is precisely why it deserves scrutiny rather than simple transcription. It is the kind of post that gets quoted in a hundred aggregator items within an hour, each one dropping the qualifications and keeping the applause line. By the time it reaches a general audience, three distinct claims have fused into one: that North Korea hacked Binance, that more than $6 billion was stolen, and that Bitcoin's price held up because law enforcement saved it. None of those three is established with the confidence the retellings imply.
This article takes the statement seriously and the numbers skeptically. It is possible to accept that Binance cooperated with U.S. investigators, that stolen funds were identified, and that some were frozen, while rejecting the specific figures and the causal story that have been attached to those facts.
Two breaches, one headline
The first problem is that the item treats "the Binance hack" as a single, self-evident event. It is not. There are at least two distinct incidents in the public record, separated by three years, by two orders of magnitude in value, and by the basic architecture of what was attacked.
The first is the May 2019 breach of Binance's own infrastructure. Attackers compromised credentials and API keys, and withdrew roughly 7,000 bitcoin from the exchange's hot wallet. At the prices prevailing at the time, that was on the order of $40 million. Binance halted deposits and withdrawals, absorbed the loss through its SAFU insurance fund rather than socializing it onto users, and eventually resumed operations. It remains the clearest case of a retail exchange being directly robbed.
The second is the October 2022 exploit of the BNB Chain cross-chain bridge — the infrastructure that moves assets between BNB Beacon Chain and BNB Smart Chain. An attacker exploited a flaw in the verification logic of the BSC Token Hub to mint roughly two million BNB out of thin air, then pushed a portion of it across chains. The nominal value was approximately $570 million. Validators were forced to halt the chain; the network was later forked and the attacker's addresses were effectively blacklisted, leaving the perpetrator holding hundreds of millions in tokens that were worth far less than face value because they could not be moved.
These are not the same event, and they are not interchangeable. One is a custodial failure inside a company; the other is a protocol-level vulnerability in a public blockchain's bridge, where no user's private key was stolen at all. Conflating them is the sort of error that happens when a summary is written from memory rather than from a source. It matters here because the attribution question — who did it — depends entirely on which incident is being discussed, and because the scale question depends on it too.
The distinction is not pedantry. A reader told that "Binance was hacked for billions by North Korea" comes away with a mental model in which a centralized exchange's customer funds were drained at nation-state scale. That model is false in both of its clauses.
The six-billion-dollar problem
The most serious error in the material in circulation is the figure itself. The claim that "more than $6 billion" was stolen does not correspond to any single theft in Binance's history, nor to any credible cumulative total. There is no basis in the public record for it.
What the record does contain is a set of comparably sized incidents that sit around the half-billion-to-$620-million mark, and it is easy to see how the error is manufactured. Take the Ronin bridge breach of March 2022, in which attackers drained 173,600 ether and 25.5 million USDC, worth roughly $620 million at the time. Take the Polygon-affiliated Poly Network exploit of August 2021, at roughly $611 million — most of which was subsequently returned. Take the BNB Chain bridge exploit itself, at roughly $570 million, commonly rendered as "$570M."
Now convert carelessly. "620 million dollars" becomes "6.2 亿" in a Chinese-language summary — a unit that means 620 million. Reverse the conversion without care and "6.2 亿" becomes "6.2 billion." A single slip of that kind turns $620 million into $6.2 billion, and a rounding to "more than $6 billion" finishes the job. The error is not a lie; it is a translation artifact, and it is one of the most common failure modes in bilingual crypto reporting, because the Chinese numbering system groups by ten-thousand rather than by thousand and every conversion is an opportunity to lose or gain an order of magnitude.
The result is a claim that is not merely wrong but wrong in a way that flatters the story. Six billion dollars sounds like a systemic threat to the asset class, which makes the law-enforcement intervention sound heroic. Six hundred million sounds like a serious but absorbable corporate catastrophe, which is what it was.
For scale, the largest crypto thefts ever recorded — the Ronin bridge, Poly Network, the BNB Chain bridge, the Wormhole bridge at roughly $320 million in February 2022, and the Nomad bridge at roughly $190 million in August 2022 — all cluster well below a billion dollars individually. FTX's collapse in November 2022 involved a shortfall in the billions, but that was insolvency and misappropriation, not a hack, and the company was not Binance.
Any downstream article that prints the $6 billion figure and attributes it to the FBI is doing something worse than making an error. It is minting a false fact and stamping it with the authority of a federal agency. Errors of that type have long half-lives: the original poster may quietly delete the line, but the syndicated copies will not follow.
What the public record actually supports
Stripped of the inflated arithmetic, the defensible version of the story is narrower and still interesting.
Binance did cooperate with U.S. authorities, repeatedly, across multiple cases. Blockchain forensics firms — Chainalysis, Elliptic, TRM Labs — traced flows from the 2022 bridge exploit through a laundering chain that included mixers and bridges to other chains. Exchange compliance teams and investigators exchanged address lists. Some funds were frozen at the point of cash-out, meaning at centralized exchanges and at stablecoin issuers able to blacklist specific addresses.
That last mechanism is the one most often misdescribed, and it is worth being precise about it, because the popular version — "law enforcement froze the money" — obscures who actually holds the switch.
Who actually freezes what
When a Tether or USDC address is blacklisted, the action is taken by the issuer, a private company exercising a contractual power embedded in the token's smart contract. The issuer can do this because the token is not truly permissionless: the contract includes an owner role with the ability to deny transfers. Circle and Tether have both used this power hundreds of times.
Exchanges freeze funds in a different way — by flagging a deposit address on their own books and refusing withdrawals, and by cooperating with the requesting agency under legal process.
Law enforcement's contribution is upstream and downstream of those actions: it identifies the targets, provides the legal instrument that compels a company to act, and supplies the evidentiary record that makes a seizure lawful. That is real and important work. It is not the same as a federal agent reaching into a wallet and switching it off.
Why does the distinction matter? Because it determines how durable the protection is. A freeze executed by a stablecoin issuer is only effective against that issuer's token; the same funds converted to bitcoin and pushed through a decentralized exchange are unaffected. The enforcement model works by squeezing the points where crypto touches the regulated financial system. It is a chokepoint strategy, not a policing of the chain itself. Zhao's post, in simplifying, presents it as something closer to the latter.
Attribution, and the gap between a press release and a press narrative
The second substantive problem is the claim that the FBI has confirmed North Korea as the perpetrator of the Binance theft.
The FBI has, in fact, publicly attributed specific crypto thefts to North Korea's Lazarus Group and its subordinate units, and it has done so by name in formal notices. The Ronin bridge breach was attributed in April 2022. The Harmony Horizon bridge theft of roughly $100 million was attributed in January 2023. Theft from Atomic Wallet was linked in 2023. The U.S. Treasury's Office of Foreign Assets Control has sanctioned address clusters and, in August 2022, the Tornado Cash mixer itself, which it described as a laundering vehicle for the Lazarus Group among others.
What is not established — and what the summarised material asserts without support — is a formal FBI attribution of the October 2022 BNB Chain bridge exploit specifically, described as "the Binance hack." Blockchain analytics firms have published tracing that connects the laundering of those funds to infrastructure associated with North Korean actors. That is meaningful evidence, and it may well be correct. It is not the same as a government attribution, and the difference between "analysts assess" and "the FBI confirms" is exactly the kind of distinction that evaporates in an aggregator.
The distinction is not a technicality for lawyers. North Korean attribution triggers a specific legal machinery: sanctions designations, asset blocking, and criminal charging decisions. When a news item upgrades a private-sector assessment into an official finding, it misleads readers about what consequences are actually in force.
The honest formulation is: the theft is widely attributed by private analysts to North Korean-linked actors, consistent with a multi-year pattern of attacks on bridges and exchanges, but the specific official finding should be checked against the FBI's published notices before being reported as one.
The Bitcoin claim, which is opinion wearing the costume of fact
The third problem is not an error of fact but a failure of logic, and it is the one most likely to be quoted.
Zhao's claim, as summarised, is that bitcoin did not fall further to a significant degree because law-enforcement intervention removed the stolen coins from the market. The implicit chain runs: funds were frozen, therefore they were not sold, therefore sell pressure was lower, therefore the price held.
The chain does not close. Consider each link.
First, subject mismatch. The assets at risk in the 2022 exploit were BNB and BNB Chain ecosystem tokens, not bitcoin. A theft of BNB has no direct mechanical relationship to BTC's order book. Using bitcoin's price as the scoreboard for an exchange or bridge security incident is a category error before any data is examined.
Second, magnitude. Daily spot bitcoin volume on major venues runs in the billions of dollars, and the spot bitcoin ETF complex alone has absorbed and discharged flows of hundreds of millions on ordinary days. Against that, even the inflated figure — $6 billion — is a quantity the market can digest. Against the accurate figure of roughly $570 million, the idea that the marginal seller determined BTC's path is not plausible. Two million BNB, even if dumped, is a BNB-market event.
Third, single-cause reasoning. Short-horizon bitcoin prices are dominated by macro liquidity conditions, real-rate expectations, ETF creation and redemption flows, perpetual futures funding and the resulting liquidation cascades, and the positioning of large holders. Security incidents are typically local, short-lived, and priced within hours. Traders sell the affected token, buy or hold the major, and move on. This is not a controversial claim; it is what the historical record of exchange failures shows.
Fourth, unfalsifiability. There is no observation that could disprove the assertion, because the counterfactual — the price path in a world where the coins had been sold — cannot be run. An unfalsifiable claim about market causation is rhetoric, not analysis.
None of which makes Zhao a liar. It makes him an interested party. He has spent years arguing that Binance's compliance posture was a net public good, and the statement is an instance of that argument. Read as a spokesperson's framing of his own company's conduct, it is coherent. Read as a causal account of bitcoin's price, it is unsupported. Reporters who repeat it as the latter are doing the spokesperson's work for free.
Why the 2019 breach was different, and why it matters to this story
Return to the first incident for a moment, because it clarifies how much the ground has shifted.
In May 2019, the attackers did not exploit a smart contract. They got in through the operational layer — credentials, API keys, and two-factor bypass techniques — and walked out through the front door. Binance's response set a template that much of the industry still follows: halt withdrawals, publish the address cluster, offer a bounty for information leading to the attackers, and cover the loss from a dedicated insurance reserve rather than from customer balances. Zhao did a live question-and-answer session to explain it. Roughly 7,000 BTC was the damage.
That incident is the one most people mean when they say "the Binance hack," and it is the one with the least plausible connection to North Korean state activity as officially determined. It was, in most contemporaneous analyses, an opportunistic criminal intrusion.
The contrast is instructive. A hot-wallet breach is a company's operational failure. A bridge exploit is a design failure in a public protocol. Enforcement cooperation looks different in each case: against the first, the useful lever is the exchange's own logs and the cash-out points; against the second, it is the validators, the bridges, and the issuers of stablecoins used to move the proceeds.
The 2022 exploit also produced one of the more striking responses in the industry's short history: BNB Chain validators coordinated to halt block production, and the network was later forked to neutralize the attacker's address. That was a governance decision taken in hours, and it remains contested. It is also the reason the nominal $570 million figure overstates the actual loss — much of the minted BNB was rendered unusable, and the attacker's realizable take was a fraction of the headline.
The enforcement playbook, and its limits
The pattern that has emerged since 2021 is consistent enough to describe as a playbook.
A bridge or exchange is drained. Analytics firms label the addresses within hours and publish flow diagrams. Centralized exchanges blacklist deposits. Stablecoin issuers blacklist the specific token addresses. Law enforcement issues subpoenas and seizure warrants, and in some cases indictments. Some funds are recovered; most are not; the attacker either launders through mixers and cross-chain bridges or sits on the assets, waiting.
The results are real but partial. In the Poly Network case, the attacker returned essentially everything within weeks — a reminder that social and reputational pressure sometimes outperforms legal process. In the Ronin case, the FBI attributed the theft and sanctions followed, but recovery of the bulk of the funds has not been reported. In many smaller cases, a subset of the proceeds is frozen at a centralized exchange before it can be withdrawn.
The distinguishing feature of this model is that it operates at the boundary between crypto and the regulated financial system. It does not police the chain. It polices the doors.
This is the substance behind Zhao's gratitude, and it is a more defensible position than the inflated version. Exchanges do hand over intelligence. Investigators do act on it. Some money is stopped. Those are facts, and they do not need a false number attached to them to be interesting.
Market structure, briefly, for the reader who wants the mechanism
If the enforcement claim about bitcoin's price is to be assessed rather than merely quoted, it helps to be clear about what moves the asset over the relevant window.
Bitcoin's price at any minute reflects the interaction of spot order books, perpetual futures with funding rates that penalize crowded positioning, and, increasingly since January 2024, the creation and redemption activity of spot ETFs through authorized participants. Large directional moves are typically preceded by funding extremes and are amplified by liquidations: leveraged longs get stopped out, market makers widen spreads, and the move overshoots before mean-reverting.
Into this system, a security incident injects a small, idiosyncratic shock. The affected token — BNB, in this case — reprices immediately. Bitcoin, if it reacts at all, does so through a sentiment channel that typically decays within days. The 2022 bridge exploit occurred during a bear market already dominated by the aftermath of Terra's collapse and the contagion that would culminate in FTX's failure six weeks later. Attributing bitcoin's behavior in that window to a frozen bridge theft requires ignoring a much larger and better-documented set of drivers.
A reader is entitled to ask: if the enforcement action had not happened, would bitcoin have fallen further? The honest answer is that no one can know, and that the effect size would likely have been too small to detect against the background noise. That is not a knock on enforcement. It is a statement about what price data can and cannot attribute.
Why the error will spread anyway
There is a mechanical reason these mistakes propagate, and it is worth naming because it will happen again.
Aggregation is cheap and verification is expensive. A post is written in one language, summarised in another, and the summary becomes the source for the next summary. Each pass drops the hedges — "reported," "assessed," "alleged" — because hedges make worse headlines. Each pass rounds numbers upward because bigger numbers travel further. Each pass merges adjacent events because a single narrative is easier to hold than two.
By the fourth pass, a $570 million bridge exploit attributed by private analysts to a North Korean unit becomes "FBI confirms North Korea stole $6 billion from Binance, and that's why bitcoin didn't crash." Every clause of that sentence is either wrong or unverified, and it is now durable, because it is memorable and it confirms what a certain audience already believes about the intersection of crypto and geopolitics.
The corrective is not complicated, but it requires discipline at the point of first publication rather than after the fact: name the event precisely, state the figure with its source and date, distinguish official attribution from analyst assessment, and label a spokesperson's causal claims as claims.
What remains genuinely unknown
Several things the reader should hold open rather than settle.
The exact timing and context of Zhao's post could not be established from the material at hand, and the context matters greatly. He pleaded guilty to anti-money-laundering and sanctions violations in November 2023, was sentenced in April 2024, served a four-month term, and was released in September 2024. A statement thanking U.S. agencies reads very differently before and after that sequence. Without a timestamp, its news value cannot be assessed.
The specific incident he was referring to — the 2019 hot-wallet breach, the 2022 bridge exploit, or some later recovery action — is likewise unresolved in the material. The scale of any actual freeze, as opposed to a nominal one, is unstated. Whether any funds were returned to users, and in what proportion, is unstated. Whether there is any source for the account beyond the post itself and secondary summaries is unstated.
These are not minor omissions. Two of them — the date and the identity of the incident — are prerequisites for writing a news item at all. Without them, the appropriate form is not a news story but an analysis of a public figure's statement, which is what this article is.
The defensible version of the story
There is a real story here, and it survives the removal of the false number.
A founder of the largest crypto exchange publicly credited U.S. law enforcement with helping contain the damage from a major theft, at a moment when the relationship between his industry and those same agencies was deeply adversarial. Binance had just paid a $4.3 billion settlement and its chief executive had been personally prosecuted. Thanking the FBI and the Secret Service in that context is a notable act of positioning, and it says something about how the industry's largest players have chosen to frame compliance: not as a cost of doing business, but as a public good they help supply.
Behind the positioning is a genuine and underreported operational reality. The chokepoint strategy works, imperfectly. Bridges are the weakest link in the crypto security model, and they have been drained repeatedly — Ronin at roughly $620 million, Poly Network at roughly $611 million, BNB Chain at roughly $570 million, Wormhole at roughly $320 million, Nomad at roughly $190 million. In several of those cases, tracing and freezing stopped a portion of the proceeds from reaching an exit. That is worth reporting accurately, and it does not need a fabricated figure to be significant.
The price claim, by contrast, should be reported as what it is: an interested party's assessment, offered without data, in a domain where the effect size is likely too small to measure. Readers can decide what weight to give it once it is labelled.
What to watch
Three things would resolve the open questions, and any of them would justify a follow-up.
First, the original post with its timestamp, which establishes whether this is news or retrospective.
Second, the FBI's published notices, which would settle whether any formal attribution exists for the October 2022 bridge exploit or whether the attribution rests entirely on private analysis. The bureau has been willing to name North Korea in other cases; the absence of a notice in this one would be informative.
Third, any disclosure from Binance or from the stablecoin issuers on the volume of funds actually frozen, as distinct from the nominal value of the addresses involved. The gap between those two numbers is usually large, and it is the difference between a public-relations gesture and a recovery.
Until those arrive, the correct posture is the one the material itself recommends and then ignores: verify before writing, and do not print a number you cannot source, especially when the number is the most quotable thing in the piece.
