FBI attribution, issuer freezes, regulator findings: which evidence belongs in an exchange's score

Criminal attribution identifies the attacker. A stablecoin freeze is recovery by a third party. A regulator's finding is about the firm's conduct. Only the last of these is evidence about what the exchange itself did — and even then Takame counts it only when there is an outcome, a guilty plea or a settlement, within the last three years. Attribution of a hack to a state-linked group does not make the exchange more culpable, and funds being frozen after the fact does not make the loss un-happen.

Three kinds of evidence, three different questions

• Criminal attribution (for example, the FBI, Secret Service and IRS Criminal Investigation naming the North-Korea-linked TraderTraitor group for the October 2026 Binance hack). This answers who did it. It does not say the exchange violated a rule. The exchange's loss is already recorded as an incident; naming the attacker does not add to or subtract from the exchange's score.
• Issuer freezes (for example, stablecoin issuers freezing more than $2.4 billion of the Binance funds). This answers how much might be recovered. It is a third party acting after the loss. It helps users, but the incident still happened, so it does not reduce the incident's weight.
• Regulator findings (an authority formally resolving a case against the firm). This answers what the firm did. This is the only one of the three that is evidence about the exchange's own conduct.

Why attribution is not an exchange violation

When a national agency attributes a theft to a particular group, it is making a criminal and national-security judgment about the people who stole the funds. It is not a ruling that the exchange broke any law. An exchange can be the victim of a sophisticated state-linked attack and still have broken no rule; a different exchange can have weak controls and never be hacked. Treating "a nation-state did it" as if it worsened the exchange's standing would double-punish the victim and reward luck. Takame records the loss because user-relevant funds left the exchange and the loss was confirmed — not because of who was blamed for it.

What Takame lets change a score

• Hacks: counted when confirmed — when a neutral dataset lists the loss, the exchange confirms it, or two independent major outlets report it. A loss of $50 million or more weighs more. Attribution of the attacker, and later recovery, do not change the figure.
• Enforcement with an outcome: a guilty plea or a settlement counts for three years. A settlement counts even when the firm admits no wrongdoing and even when no penalty figure is made public — an undisclosed amount, or one below $50 million, simply counts in a smaller tier than a disclosed penalty of $50 million or more. HTX's confidential 2026 settlement with the UK FCA is one such example. Mere charges that have not been decided do not count; dismissed cases do not count; and a case against an executive personally is not scored against the exchange.
• Registers and warnings: who is authorised or registered, and which regulators have warned about a firm, sit in the regulatory-standing part of the score — not in the incidents part, so the same event is never counted twice.

Worked example: the October 2026 Binance hack

Attackers drained funds from Binance's hot wallets on 29 October 2026; the figure Takame uses is the $6.36 billion listed by the DefiLlama hacks dataset. On 31 October the FBI, with the Secret Service and IRS Criminal Investigation, attributed the attack to TraderTraitor and published the on-chain addresses, and stablecoin issuers had frozen more than $2.4 billion. In Takame's score, the hack counts in full against Binance's Incidents part because Binance lost the funds and the loss was confirmed. The FBI's attribution to a North-Korea-linked group did not add to that, and the $2.4 billion of freezes did not subtract from it. The attribution and the freezes belong in the story of the incident, not in the measure of whether the exchange is culpable.

What you can check yourself

1. 1.Whether a "hack" report has been confirmed by a neutral dataset or a second independent outlet, before treating it as fact.
2. 2.Whether a regulatory headline is an outcome (a guilty plea or a settlement) or only a charge or an allegation — they are not the same.
3. 3.Whether a case names the exchange's legal entity, or an executive personally — only the former is about the exchange.