Eight days after North Korean hackers drained $285 million from Drift Protocol in the largest crypto theft of 2026, the U.S. Department of the Treasury moved to close a gap that has left digital asset firms fighting nation-state cyber threats with retail-grade defenses. On April 9, Treasury’s Office of Cybersecurity and Critical Infrastructure Protection announced it will extend the same actionable threat intelligence it shares with traditional U.S. financial institutions to eligible crypto firms and industry organizations, at no cost. The announcement was signed off by three senior Treasury officials and directly references the GENIUS Act and the President’s Working Group on Digital Asset Markets report from July 2025.
The policy shift is not a minor administrative update. Traditional banks have received real-time, government-grade cyber threat feeds from Treasury since at least 2015. Crypto exchanges, DeFi protocols, custody providers, and stablecoin issuers have not. During that period, the crypto industry has lost billions of dollars annually to attacks that, in many cases, were using techniques already documented in government threat databases that those firms had no access to. The FBI’s Internet Crime Complaint Center reported that cyber fraud reached $17.6 billion in losses in 2025, with crypto theft a substantial and growing component. North Korea alone stole $2.02 billion in crypto in 2025, a 51% annual increase, funding the DPRK’s weapons and military programs through a sustained, professional-grade hacking operation.
What Treasury Is Actually Offering and Who Gets Access
Treasury’s OCCIP, the office responsible for protecting the financial sector’s critical infrastructure, will share timely, actionable cybersecurity information with eligible U.S. digital asset firms and industry organizations. The program is identical in structure to what traditional financial institutions already receive: real-time threat indicators, malicious IP addresses, known attack vectors, incident alerts, and intelligence on active threat actors targeting financial infrastructure. Three senior Treasury officials confirmed the program in the April 9 press release: Luke Pettit, Assistant Secretary for Financial Institutions; Tyler Williams, Counselor to the Secretary for Digital Assets; and Cory Wilson, Deputy Assistant Secretary for Cybersecurity.
The eligibility criteria have not been fully published. Treasury’s press release states that firms must “meet Treasury’s criteria” and encourages interested organizations to contact OCCIP directly at OCCIP-Coord@treasury.gov to determine eligibility. Based on the framing of the initiative and its alignment with the GENIUS Act, which specifically governs stablecoin issuers and payment system participants, firms with U.S. registration, operational presence, and compliance programs are the most likely initial recipients. The program is designed for exchanges, custody providers, stablecoin issuers, DeFi protocol operators, and industry trade groups.
The practical value is significant. When a major bank receives a Treasury cyber alert about a new attack technique or a specific threat actor’s infrastructure, it can patch, block, or monitor within hours. When the same threat actor pivots to targeting a crypto exchange, that exchange historically received no equivalent warning. The initiative closes that operational gap. As Cory Wilson stated directly: “Cyber threats targeting digital asset platforms are growing in frequency and sophistication. This initiative expands access to actionable threat information that helps firms strengthen defenses, reduce risk, and respond more effectively to incidents.”
Treasury OCCIP Cyber Initiative: What It Is, Who It Covers, How to Join
Source: U.S. Treasury press release sb0437, April 9, 2026 | @cryptonewsbytes
| Feature | Detail |
|---|---|
| Administering office | Office of Cybersecurity and Critical Infrastructure Protection (OCCIP), U.S. Department of the Treasury |
| What is shared | Timely, actionable cybersecurity threat intelligence: same feeds provided to traditional U.S. financial institutions. Includes threat indicators, active threat actor intelligence, attack vector alerts, and incident response information. |
| Who is eligible | Eligible U.S. digital asset firms and industry organizations that meet Treasury’s criteria. Includes exchanges, custody providers, stablecoin issuers, DeFi operators, industry trade groups. Eligibility criteria to be confirmed with OCCIP directly. |
| Cost | Free. No cost to participating firms. |
| Policy basis | Advances recommendation from President’s Working Group on Digital Asset Markets report “Strengthening American Leadership in Digital Financial Technology” (July 2025). Aligns with GENIUS Act principles on cybersecurity and operational resilience. |
| How to apply | Contact OCCIP directly at OCCIP-Coord@treasury.gov to determine eligibility and begin receiving shared cybersecurity information. |
Full eligibility criteria not yet publicly published. Treasury has not provided a specific timeline for full program implementation. | @cryptonewsbytes
The Threat Landscape That Made This Initiative Unavoidable
The timing of the OCCIP announcement, just eight days after the Drift Protocol hack, is not coincidental. On April 1, 2026, North Korean state-sponsored hackers attributed with medium confidence to the UNC4736 group, also tracked as AppleJeus, Citrine Sleet, and Golden Chollima, completed a six-month social engineering operation that resulted in the theft of $285 million from the Solana-based decentralized exchange. The attack began in fall 2025 when the group infiltrated Drift’s contributor network by posing as a legitimate ecosystem participant, depositing over $1 million of their own funds to establish credibility, engaging contributors with detailed technical questions, and gradually building administrative access. On April 1 they executed a durable nonce attack, using a legitimate Solana feature to pre-sign transactions weeks in advance, triggering a rapid takeover of Drift’s Security Council administrative powers.
The Drift hack was the largest single incident in a Q1 2026 that saw $168.6 million stolen across 34 DeFi protocols, according to DefiLlama data, down 89% from Q1 2025 which was heavily skewed by the $1.4 billion Bybit breach. The year-over-year comparison flatters the industry: strip out the Bybit outlier and underlying threat activity is persistent and evolving. The attack methods are shifting from pure code exploits toward hybrid operations combining social engineering, credential theft, private key compromise, and supply chain infiltration. Step Finance lost $40 million to a private key compromise in January. Bitcoin Depot, the ATM operator, disclosed a $3.6 million cyberattack on March 23. Chainalysis documented $3.4 billion in total crypto theft for full-year 2025, with North Korea’s $2.02 billion representing 60% of all global crypto funds stolen that year.
Major Crypto Hacks Leading to the Treasury Initiative: Timeline
Source: Chainalysis, DefiLlama, Fortune, The Hacker News, The Record | @cryptonewsbytes
| Date | Incident | Loss | Method |
|---|---|---|---|
| Feb 2025 | Bybit Exchange | $1.46B | Malicious transaction signing via compromised Safe{Wallet} UI (North Korea / Lazarus) |
| Jan 2026 | Step Finance | $40M | Private key compromise – targeted operation |
| Jan 8, 2026 | Truebit Protocol | $26.4M | Smart contract manipulation |
| Mar 21, 2026 | Resolv Labs | Undisclosed | Private key compromise – cascade across 20+ protocols (“shadow contagion”) |
| Mar 23, 2026 | Bitcoin Depot (ATM) | $3.6M | Cyberattack on centralized ATM infrastructure |
| Apr 1, 2026 | Drift Protocol | $285M | 6-month DPRK social engineering + durable nonce Solana attack (UNC4736 / Lazarus) |
| Apr 9, 2026 | TREASURY OCCIP INITIATIVE ANNOUNCED: Crypto firms gain access to bank-level cyber threat intelligence |
Q1 2026 total DeFi losses: $168.6M across 34 protocols (DefiLlama). Full-year 2025 crypto theft: $3.4B (Chainalysis). North Korea 2025: $2.02B stolen, 60% of global crypto theft total. | @cryptonewsbytes
The GENIUS Act Connection: Why This Is Regulatory Infrastructure, Not a One-Off
Treasury Counselor for Digital Assets Tyler Williams explicitly linked the OCCIP initiative to the GENIUS Act in the press release, calling it an embodiment of the Act’s “principles of responsible innovation grounded in strong cybersecurity and operational resilience.” The GENIUS Act, which governs stablecoin issuance and payment system participants, includes provisions requiring robust cybersecurity controls and operational resilience standards for licensed entities. The OCCIP initiative gives those entities the government intelligence infrastructure to actually implement those standards, rather than simply mandating compliance without providing the tools to achieve it.
The initiative also directly implements a recommendation from the President’s Working Group on Digital Asset Markets report “Strengthening American Leadership in Digital Financial Technology,” published in July 2025 under Executive Order 14178. That report identified cybersecurity information sharing as a structural gap between crypto firms and traditional financial institutions and recommended extending Treasury’s threat intelligence programs to the digital asset sector. The April 9 announcement is the operational execution of that recommendation. It also builds on Treasury’s earlier 2026 initiative addressing cybersecurity risks associated with artificial intelligence in financial services.
The broader regulatory signal is significant. The OCC has approved conditional trust bank charters for firms including Circle, Ripple, BitGo, and Coinbase, placing crypto custody under the same banking regulatory framework as traditional custodians. The CLARITY Act is working through the Senate with an April window for Banking Committee markup. Japan’s FIEA bill has reclassified crypto as a financial instrument. Treasury’s OCCIP initiative fits this pattern precisely: the regulatory infrastructure being built around crypto in 2026 does not treat digital assets as a separate, lower-tier asset class. It treats them as part of the financial system, subject to the same expectations and entitled to the same resources.
How the OCCIP Initiative Works: From Threat to Defense
Source: Treasury press release sb0437, OCCIP framework, Payment Expert analysis | @cryptonewsbytes
1 Intelligence Collection OCCIP gathers cyber threat intelligence from government sources, law enforcement, international partners (FATF, BIS, CPMI), and existing financial sector participants. Includes active threat actor profiles, attack technique documentation, malicious infrastructure indicators. |
| ↓ |
2 Processing + Triage OCCIP processes raw intelligence into actionable formats: threat indicators, malicious IP/domain lists, malware signatures, attack vector briefings. Previously this processed intelligence only flowed to traditional financial institutions (banks, broker-dealers, payment processors). |
| ↓ |
3 Distribution to Eligible Firms (NEW from April 9, 2026) Eligible U.S. digital asset firms now receive the same intelligence feeds at no cost. Covers exchanges, custody providers, stablecoin issuers, DeFi operators, trade organizations. Firms contact OCCIP-Coord@treasury.gov to enroll and confirm eligibility criteria. |
| ↓ |
4 Defensive Action by Firms Firms use intelligence to patch vulnerabilities before exploitation, block malicious infrastructure, implement proactive monitoring, and improve incident response times. The goal is shifting from reactive breach response to proactive threat prevention — the model banks have used for a decade. |
The Financial Action Task Force (FATF) and Bank for International Settlements (BIS) have both recommended extending coordinated cybersecurity frameworks across all financial system participants, including digital asset firms. The OCCIP initiative aligns with this international standard-setting direction. | @cryptonewsbytes
What the Initiative Does Not Solve and Where Limits Remain
The OCCIP initiative addresses the intelligence-sharing gap. It does not address the structural vulnerabilities in smart contract design, the irreversibility of on-chain transactions that eliminates recourse after an exploit, the human attack surface exposed by social engineering campaigns like the Drift operation, or the fragmented technical standards across DeFi infrastructure that leave interoperability, custody, and key management questions unresolved. Recorded Future’s The Record noted that despite years of government warnings about North Korean threat actors, including a sustained whole-of-government effort targeting crypto firms specifically, prosecutions and alerts have not stopped either cybercriminals or nation-state hackers from repeatedly exploiting coding flaws or targeting crypto employees.
The eligibility criteria also remain vague. Treasury’s press release does not specify whether DeFi protocol operators without centralized legal entities qualify, whether non-U.S.-incorporated firms with substantial U.S. user bases are eligible, or what compliance program requirements are necessary. The Drift hack involved a decentralized exchange with no centralized custody, yet it lost $285 million to state-sponsored attackers. If the OCCIP program excludes pure DeFi operators on eligibility grounds, it leaves the most technically complex and least institutionally resourced segment of the industry outside the program.
Crypto Theft by Year: The Threat Trajectory OCCIP Is Responding To
Source: Chainalysis crypto hacking report 2025, DefiLlama Q1 2026 | @cryptonewsbytes
| 2022 | |
| 2023 | |
| 2024 | |
| 2025 | |
| Q1 2026 |
Q1 2026 YoY decline driven by absence of a Bybit-scale single incident. Underlying threat volume across 34 protocols remains persistent. North Korea’s model is shifting toward fewer, larger, more targeted operations. FBI: Total cyber fraud $17.6B in 2025. | @cryptonewsbytes
What This Means for Crypto Firms Right Now
For licensed U.S. exchanges, custody providers, and stablecoin issuers, the immediate action is straightforward: contact OCCIP-Coord@treasury.gov to confirm eligibility and begin enrollment. The intelligence shared will be the same feeds that banks currently use to defend against the same North Korean and organized cybercriminal groups that target crypto platforms. For firms already working toward OCC trust bank charters or GENIUS Act compliance, the OCCIP enrollment reinforces the regulatory relationship and signals operational maturity to counterparties and regulators alike.
The longer-term implication is structural. The OCCIP initiative, combined with the OCC charter wave, the GENIUS Act, and the CLARITY Act push, represents a coherent policy direction: digital asset firms are being integrated into the U.S. financial system’s existing regulatory and operational infrastructure, not kept at arm’s length as a separate category. The security perimeter of the U.S. financial system is being extended to include them. That is good for institutional confidence, good for consumer protection, and a net positive for the legitimacy of the asset class. It also means that the compliance bar is rising and firms that engage proactively with Treasury’s voluntary programs will be better positioned when participation eventually becomes mandatory.
Frequently Asked Questions
What is the Treasury OCCIP crypto cybersecurity initiative?
Announced on April 9, 2026, by the U.S. Department of the Treasury’s Office of Cybersecurity and Critical Infrastructure Protection, the initiative extends the same government-grade cybersecurity threat intelligence traditionally shared only with banks and traditional financial institutions to eligible U.S. digital asset firms. This includes timely, actionable threat indicators, attack vector intelligence, and incident information that helps firms identify, prevent, and respond to cyber threats targeting their platforms and customers.
Which crypto firms qualify for the Treasury OCCIP program?
Treasury has not published full eligibility criteria. The program is open to eligible U.S. digital asset firms and industry organizations that meet Treasury’s criteria. Based on the initiative’s framing and its alignment with the GENIUS Act, this is expected to include U.S.-registered exchanges, custody providers, stablecoin issuers, DeFi operators, and industry trade organizations. Firms should contact OCCIP directly at OCCIP-Coord@treasury.gov to determine their specific eligibility.
How does the Treasury cyber initiative relate to the Drift Protocol hack?
The OCCIP initiative was announced on April 9, 2026, eight days after North Korean hackers (attributed with medium confidence to UNC4736/AppleJeus/Citrine Sleet) stole $285 million from Drift Protocol in a six-month social engineering operation. The Drift hack demonstrated precisely the type of sophisticated, state-sponsored threat that the OCCIP intelligence program is designed to help firms defend against. Whether government threat feeds would have specifically flagged the UNC4736 durable nonce attack in advance is unknown, but the timing of the announcement reflects the urgency of the threat landscape.
What is the GENIUS Act and why is it mentioned in the Treasury announcement?
The GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins) is U.S. legislation governing stablecoin issuers and digital payment system participants. It includes provisions requiring robust cybersecurity controls and operational resilience standards for licensed entities. Treasury Counselor for Digital Assets Tyler Williams linked the OCCIP initiative to the GENIUS Act’s principles, framing it as providing the government intelligence infrastructure that firms need to actually implement the cybersecurity standards the Act requires, rather than simply mandating compliance without the tools to achieve it.
Further Reading
The complete breakdown of the six-month DPRK operation that directly preceded the Treasury initiative.
The parallel U.S. regulatory infrastructure buildout integrating crypto into the banking system.
The legislative framework the OCCIP initiative supports and operates alongside.
How Japan’s parallel approach to integrating crypto into financial system regulation compares to the U.S. trajectory.
This article is for informational purposes only and does not constitute financial or legal advice. Sources: U.S. Treasury press release sb0437, The Record / Recorded Future News, Chainalysis 2025 crypto hacking report, The Hacker News (Drift post-mortem). Published April 14, 2026.
