The European Banking Authority (EBA) is taking direct supervisory responsibility for key financial safeguards surrounding USDC, the dollar-linked stablecoin issued by Circle, from November 12, 2026, after classifying it as the European Union’s first significant e-money token under the bloc’s Markets in Crypto-Assets Regulation (MiCA).

The decision, announced earlier this month, marks an important development in how stablecoins are supervised in the EU, bringing the management of USDC’s reserves, liquidity and financial recovery arrangements under direct EBA oversight while leaving other supervisory responsibilities with France’s banking regulator.

For users and businesses dealing with USDC, the change does not in itself mean that the token is being withdrawn or that its basic function is changing, but it does mean that its issuer will face a different supervisory arrangement for some of the financial risks associated with the stablecoin.

USDC is a stablecoin, a type of crypto-asset designed to maintain a stable value by reference to another asset, in this case the US dollar.

Unlike cryptocurrencies whose prices fluctuate substantially, stablecoins are commonly used to transfer value, trade crypto-assets and facilitate transactions within digital asset markets.

The EBA’s classification follows an assessment of the criteria set out in MiCA, the EU’s regulatory framework for crypto-asset markets.

There are currently 45 e-money tokens notified under MiCA across the EU, with USDC becoming the first to be classified as significant.

The classification matters because MiCA provides for additional supervision of tokens deemed significant, reflecting their potential scale and importance to the financial system.

From November 12, 2026, supervisory responsibilities for USDC will be divided between the EBA and the Autorité de Contrôle Prudentiel et de Résolution (ACPR), France’s banking and insurance supervisory authority.

The EBA will take over direct supervision of the issuer’s own funds, reserve assets, liquidity requirements, and recovery and redemption plans.

These areas are central to assessing whether the issuer has adequate financial resources, can manage its assets and liabilities, and can respond to difficulties while meeting its obligations to token holders.

The ACPR will retain responsibility for other areas, including governance, qualifying holdings, fit and proper assessments, outsourcing and conflicts of interest.

The 2 authorities will work closely together to ensure a smooth transition and effective supervisory cooperation.

The change concerns the division of regulatory responsibilities rather than the introduction of a new token or a change to USDC’s stated purpose.

USDC is issued in the EU by Circle Internet Financial Europe SAS, while Circle Internet Financial, LLC issues it in the United States.

The announcement comes amid renewed scrutiny of stablecoins following the major security breach at cryptocurrency exchange Binance on October 29, which has been estimated to have affected around $6.3 billion in digital assets.

Circle, the issuer of USDC, was among the companies involved in the response, freezing more than $800 million in assets linked to the incident, according to reports.

The episode has highlighted the role stablecoin issuers can play in restricting the movement of assets and the importance of cooperation across the digital asset industry.

However, the EBA’s new supervisory responsibilities concern the financial safeguards supporting USDC and should not be confused with direct oversight of cryptocurrency exchanges or their cybersecurity arrangements.

That cross-border structure also means that cooperation between regulators is important when monitoring the stablecoin’s activities across different jurisdictions.

To support its supervision of cross-border stablecoin activity, the EBA has signed a memorandum of understanding with the New York State Department of Financial Services.

The agreement is intended to facilitate cooperation and information exchanges between the 2 authorities.

The decision is based on MiCA, which gives the EBA responsibility for classifying asset-referenced tokens (ARTs) and e-money tokens (EMTs) as significant under Articles 43 and 56.

The authority assesses annually whether tokens should be classified as significant or whether they continue to meet the relevant criteria.

The indicators used in these assessments are specified in Commission Delegated Regulation (EU) 2024/1506, alongside the procedure set out in EBA Decision EBA/DC/558.

Under MiCA, issuers of significant ARTs are placed under EBA supervision, while issuers of significant EMTs are subject to dual supervision by the EBA and the relevant national competent authority.

This arrangement is set out in Article 117 of the regulation, with Articles 117(5) and 128 requiring the EBA to exercise its powers in close cooperation with other competent authorities.

The framework also provides for cooperation through supervisory colleges established under Article 119.

For the wider crypto-asset market, USDC’s designation establishes a precedent for how the EU will apply its significant-token framework as the market develops.

The immediate practical effect is a redistribution of supervisory responsibilities, but the broader aim is to strengthen oversight of the financial safeguards supporting a stablecoin that operates across borders.

Hackers stole $6.3 billion from Binance, the world’s biggest cryptocurrency exchange, in a record digital asset theft.

How was Binance hacked?

About $6.3 billion of cryptocurrencies were drained from wallets that Binance uses to process transactions, according to the exchange and expert analysis of blockchain records.

Binance said in a statement on X that it initially thought the attack involved a compromised laptop. “However, our subsequent investigation has uncovered additional points of breach,” it added, without elaborating.

The exchange operates a secure asset fund for users, a $1 billion bitcoin reserve designed to protect customers in the event of a security breach, according to its website.

Co-CEO Richard Teng said losses would be covered by the fund and company resources.

According to US blockchain analytics firm TRM Labs, the attackers compromised Binance’s “signing infrastructure”, which authorizes transactions, allowing them to issue instructions that emptied the affected wallets.

The bulk of the heist unfolded in about 20 minutes, blockchain records show, beginning shortly after 2000 GMT on Thursday.

Once the funds were moved, the attackers raced to shift them beyond the reach of Binance counterparties and stablecoin issuers, which have frozen roughly half of the stolen assets.

An unusual feature of some cryptocurrencies, including major stablecoins such as Tether’s USDT and Circle’s USDC, is that their issuers can freeze them remotely.

“In layman’s terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money,” said Joshua Chu, a Hong Kong lawyer who works on crypto cases.

Who is suspected of carrying out the Binance hack?

Several US blockchain analysis firms said the attack bears similarities to previous operations attributed to North Korean hackers.

Teng said Binance’s investigation had not yet identified the attackers, while North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts. North Korea’s mission in Geneva and embassy in China did not immediately respond to requests for comment.

TRM said the breach shared characteristics with last year’s attack on crypto exchange Bybit, which the FBI attributed to North Korean hackers. The firm said it was highly confident the same group was behind the Binance theft.

Chainalysis said funds stolen in an attack last month on Bitget were being mixed with proceeds from the Binance breach.

Where did the stolen $6.3 billion go?

About half the stolen assets were stablecoins that have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family’s crypto venture.

That doesn’t mean the coins will be returned to Binance, but it significantly limits the attackers’ ability to convert them into cash.

TRM said some of the funds had already been posted as collateral to borrow ether and estimated that about $2.4 billion worth of bitcoin and ether is beyond reach.

“No company issues bitcoin or ether and no company can freeze either one,” said Patrick Tan, general counsel of ChainArgos, a blockchain intelligence firm in Singapore.

“The bitcoin and ether can be stopped only if the attacker sends them to a crypto-asset exchange or broker that is able and willing to freeze them, or if law enforcement obtains the private keys.”

Market participants said the attackers would likely mix the stolen coins with other assets or use lesser known coins and exchanges to try to move the proceeds.

“The more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers — they essentially get blacklisted,” said Bernardo Brites, CEO of Trace Finance, a stablecoin infrastructure company.

“In reality a lot of the proceeds of hacks … (can only be laundered) in the first few hours, but after that happens, you have a lot of different players who know those are marked funds … and they usually sit there for years.”

What happens next after the Binance hack?

The theft is the latest in a series of major digital asset breaches. Attackers stole $2.9 billion of cryptocurrency across nearly 150 incidents last year, according to TRM Labs.

The attack has also rattled confidence in the sector. Cryptocurrencies fell on Friday and the total market value of stablecoins declined, suggesting investors were pulling money from digital assets.