The Binance attack is exposing the risks inherent in the digital assets sector. Here’s how policymakers should respond.
As discussed in a previous blog post, the multi-billion-dollar attack on Binance—which appears to have been carried out by North Korea—illustrates the national security imperative of enacting stricter regulatory standards on the risky digital assets sector.
Now, let’s look at precisely what that means, and why the crypto sector’s claimed security backstops are a mirage.
ICBA sounded this alarm years ago
In January 2024, ICBA told the Financial Crimes Enforcement Network (FinCEN) that North Korea’s theft of billions in digital assets posed a national security threat and that enhanced bank reporting on mixers was not enough. Policymakers, we argued, needed to confront the wider ecosystem: decentralized exchanges, bridges, and unhosted wallets.
In November 2025, we warned Treasury that stablecoin freezes have limits: bad actors know they exist and race to convert tokens into other cryptoassets. We called for a government-led response to North Korea built on deterrence, not detection after the damage is done.
In June and July 2026, our letters to FinCEN and the Office of Foreign Assets Control and to the OCC insisted that nonbank stablecoin issuers offering bank-like payment products must not operate under weaker illicit-finance safeguards than community banks.
These were not isolated objections to individual technologies. They were a consistent warning that crypto’s regulatory perimeter has too many holes—and that North Korea has proven, again and again, that it knows how to find them.
Mixers and DeFi: the getaway routes
Investigators, including Chainalysis, report that the Binance attacker’s operational wallet was funded through Tornado Cash—evidence of attack preparation, not proof that the stolen proceeds later passed through the mixer. But Chainalysis has documented that North Korea relies on mixers and bridges more heavily than other thieves.
Mixers exist to sever funds from their origins. For a sanctioned nuclear regime, that is not a privacy feature. It is operational infrastructure.
FinCEN knew this. When it proposed its mixer rule in 2023, it named North Korea’s Lazarus Group among the illicit actors laundering funds through mixers. Yet on Oct. 5, it withdrew that proposal—a reporting and recordkeeping requirement, not a ban—along with a separate unhosted-wallet proposal, and put nothing in its place.
The withdrawal did not cause this hack, and existing AML and sanctions obligations still apply. But FinCEN stood down on mixers while the North Korean threat was escalating. Twenty-four days later came the largest crypto theft in history. FinCEN should not wait for the next one to reverse course.
DeFi is the next exit ramp. These protocols exchange assets, extend credit, and move value, often without customer identification, suspicious activity monitoring, or sanctions screening. Not every protocol participant is complicit. But when a thief needs to turn freezable stablecoins into assets that cannot be frozen, permissionless swaps and lending markets offer a way to do it in minutes—and no one in the path is clearly obligated to ask where the money came from.
ICBA has long held that a “decentralized” label should not end the regulatory inquiry. Policymakers must ask who operates a service, who controls it, who profits from it, and who performs functions that carry legal obligations. Writing code is not the same as running a financial service. But “decentralized” cannot be a magic word that turns bank-like activity into a compliance-free zone.
Stablecoin freezes are a backstop, not a safeguard
The industry will tout one success: Elliptic has verified $2.84 billion in frozen funds—44 percent of the theft, almost all of it in USDT and USDC. Those interventions matter. But a freeze is a reaction after the theft, it depends on how fast an issuer moves, and frozen is not the same as recovered.
The rest—more than half the haul—is beyond the reach of any issuer’s freeze, and Elliptic reports the attacker is swapping it into ether and other assets that cannot be frozen. Those funds may still be traced or seized by other means, but the playbook is plain: move what can be frozen into what cannot.
ICBA flagged exactly this limitation to Treasury in 2025. Strong stablecoin rules are necessary but not sufficient when the surrounding ecosystem offers so many exits. Freezing powers must not become a talking point that hides the larger gap. Any credible framework must reach the exchanges, protocols, and bridges that stolen value travels through.
The transparency myth
Crypto advocates claim public blockchains make illicit finance self-defeating because every transaction is visible. Analysts have tracked the Binance funds in real time, and that work deserves credit. But watching a theft is not stopping it. A public ledger that records billions leaving an exchange is a very detailed receipt. It is not a safeguard.
We have seen this before. In February 2025, North Korea’s TraderTraitor stole about $1.5 billion from Bybit, according to the FBI, which urged exchanges, bridges, DeFi services, and other providers to help block the stolen funds.
Twenty months later, North Korea appears to have struck again at more than four times the scale. When the same playbook keeps working, the problem is not one firm. It is the system.
Accountability cannot stop at the bank’s door
Community banks already shoulder rigorous duties: customer due diligence, suspicious activity reporting, recordkeeping, sanctions compliance, and regular examinations. They will keep meeting them.
But it is backward to impose the strictest rules on the institutions farthest from crypto risk while the mixers, protocols, bridges, and platforms that stolen funds actually travel through face lighter, unclear, or no comparable obligations.
ICBA’s 2026 letters make the right demand: stablecoin issuers must face an AML and sanctions framework no weaker than the one applicable to community banks—with programs that work in practice, not just on paper, and clear responsibility for stablecoin-specific risks. A community bank providing an ordinary account cannot police an entire token network.
What policymakers must do now
The response must match the threat. A nuclear-armed adversary is financing weapons through gaps that policymakers have the power to close. They should act now to:
-
Treat North Korean crypto theft as proliferation financing. Treasury, State, Justice, and the FBI should lead a coordinated campaign with Seoul and Tokyo to disrupt, deter, and recover stolen funds before they become missiles.
-
Close the mixer gap. FinCEN should promptly replace its withdrawn proposal with a stronger, workable rule aimed at the services that obscure illicit funds, not merely more downstream bank paperwork.
-
End the decentralization loophole. Assign AML and sanctions obligations based on function and control, and keep DeFi and bridge carve-outs out of market structure legislation.
-
Hold stablecoin issuers to community bank standards. Ensure GENIUS Act rules require effective AML programs, sanctions screening, and the ability to freeze illicit funds quickly in coordination with law enforcement.
-
Shut down the off-ramps. Sanction the OTC brokers, offshore platforms, and facilitator networks that turn stolen crypto into usable cash.
-
Lead internationally. Back the Multilateral Sanctions Monitoring Team, and press Financial Action Task Force members to close proliferation-financing gaps so North Korea cannot route around U.S. rules.
-
Put responsibility where the risk is. Community banks will do their part, but they cannot be the cleanup crew for an ecosystem policymakers have left porous.
North Korea does not need to defeat every safeguard in crypto. It only needs to find the gaps between them—and it keeps finding them. Each gap is a potential funding stream for a nuclear arsenal and the missiles built to deliver it to Seoul, Tokyo, and, increasingly, the American homeland.
ICBA has spent years connecting these dots. The time for warnings is over. Policymakers must close these gaps now, before the next record-breaking heist bankrolls the next missile launch.
Brian Laverdure is ICBA senior vice president of digital assets and innovation policy.