regulation ·
Binance Hack Shows Why Offshore Exchanges Need US Oversight, CFTC Chair Says
The record-breaking theft of approximately $6.4 billion from Binance illustrates, according to CFTC Chair Michael Selig, the necessity for offshore exchanges to comply with U.S. regulatory requirements and adopt cybersecurity standards comparable to those in American financial markets.
Speaking to CNBC on Friday, Selig asserted that the Binance breach "proves our exact point" regarding the crypto-market regulations the agency proposed earlier this month. He stated that the fundamental issue lies with the fact that these are offshore exchanges operating without regulation, meaning they lack the same protective measures present in the United States' financial markets. Selig advocated for a "federal option" whereby such platforms could register with the CFTC and adhere to the identical cybersecurity benchmarks governing U.S. markets.
Selig attempted to minimize the role of the blockchain itself in the incident. He maintained that the exploit did not compromise the underlying blockchain, which in this instance was Ethereum, nor its smart contracts; instead, he claimed it exploited a vulnerability he believed originated "from someone’s laptop," a type of occurrence also seen in conventional markets. He noted that the distinguishing factor in crypto is the speed, as funds can move much quicker, and malicious actors can obscure their tracks using tools such as Tornado Cash.
However, Selig's assessment might be incomplete. Initially, Binance cited a compromised laptop belonging to a DevOps engineer, but on Friday, the company announced that its investigation had uncovered "additional points of breach," with CEO Richard Teng characterizing it as "a more complex attack process" that "did not simply use one engineer’s permissions."
Although the theft did not reveal a weakness within Ethereum itself, the attack did manifest partly on-chain. Specifically, the attacker utilized EIP-7702, an Ethereum function allowing standard wallets to execute smart-contract code, to transform a Binance hot wallet into a "sweeper" by employing 50 pre-signed authorizations, thereby draining its holdings. TRM Labs suggested that the wider breach indicates a compromise within Binance's signing infrastructure rather than any flaw in the blockchain technology. Despite this, Selig framed the blockchain's inherent transparency as a regulatory advantage. He remarked, "The fact that we can trace transactions on-chain, even when some of these technologies are used to obfuscate that, gives regulators a lot of potential to be really cop on the beat here."
These statements reinforce a position Selig has been promoting for several weeks. The CFTC has proceeded with its own rulemaking concerning crypto assets, bypassing a wait for Congress. This includes submitting White House proposals that define event contracts as "swaps" and outlining a plan to bring crypto exchanges under federal supervision, as part of a broader regulatory shift where agencies have taken the lead following the stalling of the Clarity Act in the Senate. The Binance hack provides a striking example to support this ongoing effort.
The exploit represents the largest in crypto history, with Binance allocating $6.34 billion to cover the incurred losses and assuring its users that their holdings remain secure. Furthermore, the Secret Service and the FBI have initiated an inquiry, and both TRM Labs and Chainalysis have linked the theft to North Korea’s TraderTraitor group.
Earlier coverage
Reported by Decrypt.
