Fed and OCC phoned banks after Binance hack as cyber rule took effect

Federal Reserve and OCC supervisors started calling U.S. banks to check for vulnerabilities after the $6.3 billion Binance hack.

On the same day the calls started, a new OCC and FDIC rule took effect, narrowing when examiners can force banks to fix cybersecurity flaws.

When can banks be forced to fix cybersecurity issues?

On Monday, November 2, supervisors from the Federal Reserve and the Office of the Comptroller of the Currency (OCC) began phoning banks asking if they had experienced any service disruptions or anything out of the ordinary on their systems.

Several people familiar with the outreach described the calls, according to Reuters.

One bank that took a call reported no interruptions. Its staff had drawn up talking points to use with customers but ended up fielding a few questions.

Binance said it knew nothing of the exchanges between bankers and regulators, but stated that it is keeping regulators all over the world up to date on the security breach.

Also on November 2, a joint rule from the OCC and FDIC took effect, raising the bar for when examiners can order a bank to fix a problem. The two agencies adopted the rule on August 27 and published it in the Federal Register on September 1.

The rule sets out, for the first time in regulation, what counts as an “unsafe or unsound practice.” It also makes it harder to issue a matter requiring attention (MRA), which is the formal written notice examiners use to tell a bank it must fix a problem.

To issue an MRA now, examiners must link the weakness to likely serious harm to the bank’s finances or to a real violation of law. Problems that do not meet this test become supervisory observations. These observations don’t come with an action plan, are not tracked as formal findings, and do not have to be shared with the board.

The Federal Reserve did not sign on, so banks it oversees are not covered. The Fed has pursued a similar standard through internal policy instead.

The OCC kept a separate power to force banks to fix serious security weaknesses, even when there is no link to the bank’s finances. The FDIC said it would use that power only rarely, and only under the same strict standard.

What have banks done following the Binance hack?

Banks have reportedly been picking apart the Binance hack and running diagnostics on their own systems to see whether they could survive a similar attack.

Within hours of the theft, a security team at one of the largest U.S. banks contacted its counterparts at Binance. The team is now writing an internal report that one source said could lead to a review of the bank’s systems and possible cybersecurity updates.

The speed at which AI models are improving makes it harder for banks to stay ahead of attackers. Banks have reportedly started pouring resources into reviews and code patches.

Cryptopolitan covered the Binance hack that happened on October 29, reporting that roughly $6.3 billion was drained from the exchange. The incident is regarded as the largest crypto theft on record.

In its incident report, Binance said the attack began in June when a wallet engineer installed a tampered AI coding tool. It escalated in September after a second engineer downloaded malicious code following a fake job interview. The attackers later made use of an internal AI tool with stolen credentials to gain access to the exchange’s wallets.

The FBI blamed North Korea’s TraderTraitor group in an October 31 alert, a claim Pyongyang rejected. Co-CEO Richard Teng said Binance had replaced about 95% of the stolen funds from its own reserves and that the exchange remained financially sound.