DeFi

Symbiosis

Chad

THORChain

Chainflip

<p><strong>Following Binance’s roughly $6.3 billion hack, the <a href="https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack" rel="noopener noreferrer nofollow">FBI</a> asked THORChain node operators and other decentralized finance (DeFi) services to block transactions linked to the stolen funds. </strong></p>
<p>The request came on October 31. THORChain’s nodes operate independently, and no single authority can make them block the transactions.</p>
<h3 class="wp-block-heading" id="strong-what-the-fbi-asked-for-and-what-barraford-said-back-strong"><strong>What the FBI asked for, and what Barraford said back</strong></h3>
<p>The bureau blamed TraderTraitor—its name for a North Korean state-linked hacking operation—for the October 29 theft. It asked services to block listed wallets and transactions derived from them. The attackers, it said, were converting stolen crypto into Ether.</p>
<p>The FBI has identified 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address. However, it has not included any address on Tron despite the fact that this blockchain has been widely used to move the stolen funds.</p>
<p>According to Chad Barraford, the technical co-founder of THORChain, node operators have already been able to see transactions on public blockchains. He informed <a href="https://www.theblock.co/news/defi/2026-11-01-north-korean-hackers-launder-242-million-of-binance-loot-via-tron-as-fbi-presses-thorchain-analyst-432257" rel="noopener noreferrer nofollow">The Block</a> that the official website had blocked the aforementioned addresses. However, he expects the independent node operators to continue trading as before.</p>
<h3 class="wp-block-heading" id="strong-where-the-frontend-ends-and-the-nodes-begin-strong"><strong>Where the frontend ends, and the nodes begin</strong></h3>
<p>It is important to differentiate between THORChain’s website and the THORChain network itself. The website serves the function of giving the option to perform a swap. But the protocol works through separate nodes that can be reached through other interfaces.</p>
<p>This means that the blocking of an address from the site does not mean that a transaction cannot be conducted in another way. So far, it’s unclear whether node operators have blocked those addresses across the network.</p>
<h3 class="wp-block-heading" id="strong-a-separate-halt-that-caught-legitimate-users-strong"><strong>A separate halt that caught legitimate users</strong></h3>
<p>Another issue then led to the halting of trading activity. On 31 October, an Ethereum block reorganization occurred, which prompted THORChain to refund 10 ETH coming from vaults that had not received deposits.</p>
<p>The shortfall was picked up by the solvency checker. This forced the operators to prolong the break and, as a result, on 1 November, trading on <a href="https://www.theblock.co/news/defi/2026-11-01-north-korean-hackers-launder-242-million-of-binance-loot-via-tron-as-fbi-presses-thorchain-analyst-432257" rel="noopener noreferrer nofollow">10 out of the connected 13 chains</a> was suspended. All parties suffered losses. The halt was meant to protect the network, not to carry out the FBI’s request.</p>
<h3 class="wp-block-heading" id="strong-the-numbers-are-estimates-not-settled-facts-strong"><strong>The numbers are estimates, not settled facts</strong></h3>
<p>The stolen funds moved swiftly, complicating the ability to accurately gauge the total amount. Analyst SomaXBT believes that around <a href="https://x.com/somaxbt/status/2116884703655723207" rel="noopener noreferrer nofollow">$242 million was transferred via the Tron blockchain</a> in two days.</p>
<p>The vast majority, about $140 million, of this total was transferred through a variety of cross-chain services. Relay transferred almost $48 million, THORChain moved $44 million, Chainflip transferred $32.1 million, and Symbiosis $16 million. The aforementioned figures are estimates.</p>
<p>Additionally, they do not suggest that THORChain had any knowledge of the hackers’ wrongdoing.</p>
<figure class="wp-block-image size-full">
 <figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/11/THORChain_Binance_FBI_Cryptopolitan_Infographic_1024x576.png" alt="" width="1024" height="576">
  <figcaption>
   Binance Hack: FBI–THORChain Timeline and $140M in Estimated Cross-Chain Outflows
  </figcaption>
 </figure>
</figure>
<h3 class="wp-block-heading" id="strong-why-screening-one-wallet-at-a-time-may-not-hold-strong"><strong>Why screening one wallet at a time may not hold</strong></h3>
<p>The rapid movement of stolen funds makes wallet-by-wallet screening difficult. <a href="https://www.elliptic.co/insights/how-north-korea-is-laundering-the-6-4-billion-stolen-from-binance/" rel="noopener noreferrer nofollow">Elliptic</a> tracked about 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days. It found signs of automated laundering, but no evidence that AI agents were directing it. With funds constantly moving to new wallets, fixed blocklists can quickly fall behind.</p>
<p>For THORChain, the challenge is how quickly it can respond. In an earlier <a href="https://unchainedcrypto.com/thorchain-says-it-cant-block-north-korean-laundering-is-that-true" rel="noopener noreferrer nofollow">debate</a>, researcher Taylor Monahan argued that the network could halt suspicious routes. Barraford maintained that reaching two-thirds node consensus—agreement from a supermajority of operators—could take days or weeks. Acting faster, he argued, would require more centralized control.</p>
<h3 class="wp-block-heading" id="strong-the-stakes-for-liquidity-compliance-and-trust-strong"><strong>The stakes for liquidity, compliance and trust</strong></h3>
<p>Binance, meanwhile, is working to rebuild customer confidence. The exchange <a href="https://www.cryptopolitan.com/binance-completes-proof-of-reserves-after-6-3b-hack-as-withdrawals-resume/" rel="noopener noreferrer nofollow">completed proof of reserves</a>, a snapshot showing whether specified customer balances are backed by assets. It also promised to cover the losses.</p>
<p>Still, <a href="https://www.reuters.com/business/finance/binance-sees-outflows-stabilising-exchange-returns-online-after-63-billion-heist-2026-11-02/" rel="noopener noreferrer nofollow">Reuters</a> reported $4.72 billion in net withdrawals, about 3% of platform assets, despite $2.7 billion in inflows. <a href="https://www.cryptopolitan.com/is-thorchain-turning-into-a-hub-for-crypto-hackers" rel="noopener noreferrer nofollow">Cryptopolitan</a> has previously examined THORChain’s exposure to stolen funds. The latest case brings a familiar challenge back into focus: how can DeFi keep liquidity open without compromising compliance and user trust?</p>
<p>If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.</p>

THORChain faces FBI pressure as Binance hack funds move across DeFi

Table of Contents

Cryptopolitan_News

Other articles published on Nov 3, 2026

Join our free newsletter for daily crypto updates!